xmrig | 20afb7b37669457821818a4afe750fdd68efd1437ecfc23761c8c9997a24385a

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
Size

2.0MB
MD5

5b9380a6d75888299500588afbe2fa60
SHA1

c520f9767d1335e85904aef2575698fe35d9d3aa
SHA256

20afb7b37669457821818a4afe750fdd68efd1437ecfc23761c8c9997a24385a
SHA512

d20f308dc01a170ce85910f1eaab902a0c5cb91cdda5884e67aadfe71cb61321c525b0fc6cee3c6bf22a2ede2699390238797660451d82f019e6d2b803957f4d
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQF3OioF5qdhl:BemTLkNdfE0pZrQ3

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4324-0-0x00007FF712F50000-0x00007FF7132A4000-memory.dmp	xmrig
behavioral2/files/0x00090000000233ce-4.dat	xmrig
behavioral2/files/0x00070000000233ea-7.dat	xmrig
behavioral2/files/0x00070000000233eb-27.dat	xmrig
behavioral2/files/0x00070000000233f0-44.dat	xmrig
behavioral2/files/0x00070000000233ec-59.dat	xmrig
behavioral2/files/0x00070000000233f6-70.dat	xmrig
behavioral2/memory/1504-80-0x00007FF6B5090000-0x00007FF6B53E4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f2-99.dat	xmrig
behavioral2/memory/3504-107-0x00007FF769240000-0x00007FF769594000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fb-128.dat	xmrig
behavioral2/memory/3308-147-0x00007FF60B990000-0x00007FF60BCE4000-memory.dmp	xmrig
behavioral2/memory/4900-162-0x00007FF7D7FB0000-0x00007FF7D8304000-memory.dmp	xmrig
behavioral2/memory/4204-165-0x00007FF7300C0000-0x00007FF730414000-memory.dmp	xmrig
behavioral2/memory/2012-169-0x00007FF7B2C30000-0x00007FF7B2F84000-memory.dmp	xmrig
behavioral2/memory/3256-173-0x00007FF7CE060000-0x00007FF7CE3B4000-memory.dmp	xmrig
behavioral2/memory/2424-175-0x00007FF6D5BC0000-0x00007FF6D5F14000-memory.dmp	xmrig
behavioral2/memory/4776-174-0x00007FF602D40000-0x00007FF603094000-memory.dmp	xmrig
behavioral2/memory/4056-172-0x00007FF7BF2F0000-0x00007FF7BF644000-memory.dmp	xmrig
behavioral2/memory/1880-171-0x00007FF7E38C0000-0x00007FF7E3C14000-memory.dmp	xmrig
behavioral2/memory/1960-170-0x00007FF627820000-0x00007FF627B74000-memory.dmp	xmrig
behavioral2/memory/3636-168-0x00007FF6E2F50000-0x00007FF6E32A4000-memory.dmp	xmrig
behavioral2/memory/4260-167-0x00007FF6E41B0000-0x00007FF6E4504000-memory.dmp	xmrig
behavioral2/memory/3792-166-0x00007FF731720000-0x00007FF731A74000-memory.dmp	xmrig
behavioral2/memory/2800-164-0x00007FF776BE0000-0x00007FF776F34000-memory.dmp	xmrig
behavioral2/memory/400-163-0x00007FF7259D0000-0x00007FF725D24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023404-160.dat	xmrig
behavioral2/files/0x0007000000023403-158.dat	xmrig
behavioral2/memory/2564-157-0x00007FF612490000-0x00007FF6127E4000-memory.dmp	xmrig
behavioral2/memory/1068-156-0x00007FF7214E0000-0x00007FF721834000-memory.dmp	xmrig
behavioral2/files/0x0007000000023402-154.dat	xmrig
behavioral2/files/0x0007000000023401-152.dat	xmrig
behavioral2/files/0x0007000000023400-150.dat	xmrig
behavioral2/files/0x00070000000233fe-148.dat	xmrig
behavioral2/memory/2852-144-0x00007FF6EC920000-0x00007FF6ECC74000-memory.dmp	xmrig
behavioral2/memory/4148-143-0x00007FF6EAFA0000-0x00007FF6EB2F4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fd-137.dat	xmrig
behavioral2/files/0x00070000000233ff-134.dat	xmrig
behavioral2/files/0x00070000000233fc-133.dat	xmrig
behavioral2/memory/3892-124-0x00007FF705180000-0x00007FF7054D4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fa-115.dat	xmrig
behavioral2/files/0x00070000000233f9-114.dat	xmrig
behavioral2/files/0x00070000000233f8-113.dat	xmrig
behavioral2/files/0x00070000000233f7-103.dat	xmrig
behavioral2/memory/1700-95-0x00007FF638170000-0x00007FF6384C4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023407-185.dat	xmrig
behavioral2/files/0x0007000000023408-190.dat	xmrig
behavioral2/files/0x0007000000023405-180.dat	xmrig
behavioral2/files/0x00070000000233f5-94.dat	xmrig
behavioral2/files/0x00070000000233f4-88.dat	xmrig
behavioral2/files/0x00070000000233f3-86.dat	xmrig
behavioral2/files/0x00070000000233ee-73.dat	xmrig
behavioral2/files/0x00070000000233f1-71.dat	xmrig
behavioral2/memory/5088-64-0x00007FF756A90000-0x00007FF756DE4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233ef-54.dat	xmrig
behavioral2/memory/1620-49-0x00007FF66CAD0000-0x00007FF66CE24000-memory.dmp	xmrig
behavioral2/memory/3404-47-0x00007FF7BCAF0000-0x00007FF7BCE44000-memory.dmp	xmrig
behavioral2/files/0x00070000000233ed-33.dat	xmrig
behavioral2/memory/724-37-0x00007FF660F40000-0x00007FF661294000-memory.dmp	xmrig
behavioral2/memory/64-22-0x00007FF7BAEE0000-0x00007FF7BB234000-memory.dmp	xmrig
behavioral2/files/0x00080000000233e6-15.dat	xmrig
behavioral2/memory/4328-9-0x00007FF795090000-0x00007FF7953E4000-memory.dmp	xmrig
behavioral2/memory/4328-2124-0x00007FF795090000-0x00007FF7953E4000-memory.dmp	xmrig
behavioral2/memory/724-2125-0x00007FF660F40000-0x00007FF661294000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4328	ePfMPLp.exe
64	RrjGFHV.exe
724	MvyiKOk.exe
3636	FhFAYQz.exe
3404	DTluPQZ.exe
1620	BMwNlRz.exe
2012	bGRDRqT.exe
5088	gIijHGm.exe
1504	PDLNWjZ.exe
1700	Unqsjrl.exe
1960	IkosEYN.exe
3504	udPhBFa.exe
3892	jsJyosj.exe
1880	INvHirY.exe
4148	knQOEYk.exe
2852	wWLfiru.exe
4056	KXwGWOE.exe
3308	FXmrmvL.exe
1068	iKhczKu.exe
3256	RpTqSoi.exe
2564	YIGcHzM.exe
4900	haPrUDZ.exe
4776	wmOzHaL.exe
400	qdxUpCA.exe
2800	DgQbSkJ.exe
4204	FGvWbFS.exe
3792	YfHvHhb.exe
2424	tVGNCBG.exe
4260	aexBxwA.exe
4720	wnzDOfm.exe
3828	iysQpeg.exe
2072	NgesGgL.exe
3464	mSGMVKI.exe
4160	pkfYhtM.exe
3584	OdFLgCH.exe
4176	PeMgjEa.exe
2756	nJFAyqm.exe
3168	guJBWlQ.exe
3696	aqvEzhq.exe
4832	nRlGrVs.exe
652	RUdOUsX.exe
5092	XbwFCJj.exe
312	bGMxhDe.exe
2512	jLeklKr.exe
5064	ZlLWjXa.exe
4940	HNAUohR.exe
848	eTrjfve.exe
2916	RConzni.exe
5028	Zgftiss.exe
1480	iHLDnxn.exe
4976	brmZOik.exe
2428	DUcHMPH.exe
1056	wEcPXzk.exe
4864	MizmzNo.exe
1584	BYHkmMJ.exe
4972	PlARlla.exe
4920	thrXiLM.exe
2828	mXhMTpB.exe
3388	yqpNJmu.exe
3916	PqBewDv.exe
2176	tZjsULY.exe
772	FtHZAHW.exe
540	wXHAmjf.exe
2368	RhVKMfm.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4324-0-0x00007FF712F50000-0x00007FF7132A4000-memory.dmp	upx
behavioral2/files/0x00090000000233ce-4.dat	upx
behavioral2/files/0x00070000000233ea-7.dat	upx
behavioral2/files/0x00070000000233eb-27.dat	upx
behavioral2/files/0x00070000000233f0-44.dat	upx
behavioral2/files/0x00070000000233ec-59.dat	upx
behavioral2/files/0x00070000000233f6-70.dat	upx
behavioral2/memory/1504-80-0x00007FF6B5090000-0x00007FF6B53E4000-memory.dmp	upx
behavioral2/files/0x00070000000233f2-99.dat	upx
behavioral2/memory/3504-107-0x00007FF769240000-0x00007FF769594000-memory.dmp	upx
behavioral2/files/0x00070000000233fb-128.dat	upx
behavioral2/memory/3308-147-0x00007FF60B990000-0x00007FF60BCE4000-memory.dmp	upx
behavioral2/memory/4900-162-0x00007FF7D7FB0000-0x00007FF7D8304000-memory.dmp	upx
behavioral2/memory/4204-165-0x00007FF7300C0000-0x00007FF730414000-memory.dmp	upx
behavioral2/memory/2012-169-0x00007FF7B2C30000-0x00007FF7B2F84000-memory.dmp	upx
behavioral2/memory/3256-173-0x00007FF7CE060000-0x00007FF7CE3B4000-memory.dmp	upx
behavioral2/memory/2424-175-0x00007FF6D5BC0000-0x00007FF6D5F14000-memory.dmp	upx
behavioral2/memory/4776-174-0x00007FF602D40000-0x00007FF603094000-memory.dmp	upx
behavioral2/memory/4056-172-0x00007FF7BF2F0000-0x00007FF7BF644000-memory.dmp	upx
behavioral2/memory/1880-171-0x00007FF7E38C0000-0x00007FF7E3C14000-memory.dmp	upx
behavioral2/memory/1960-170-0x00007FF627820000-0x00007FF627B74000-memory.dmp	upx
behavioral2/memory/3636-168-0x00007FF6E2F50000-0x00007FF6E32A4000-memory.dmp	upx
behavioral2/memory/4260-167-0x00007FF6E41B0000-0x00007FF6E4504000-memory.dmp	upx
behavioral2/memory/3792-166-0x00007FF731720000-0x00007FF731A74000-memory.dmp	upx
behavioral2/memory/2800-164-0x00007FF776BE0000-0x00007FF776F34000-memory.dmp	upx
behavioral2/memory/400-163-0x00007FF7259D0000-0x00007FF725D24000-memory.dmp	upx
behavioral2/files/0x0007000000023404-160.dat	upx
behavioral2/files/0x0007000000023403-158.dat	upx
behavioral2/memory/2564-157-0x00007FF612490000-0x00007FF6127E4000-memory.dmp	upx
behavioral2/memory/1068-156-0x00007FF7214E0000-0x00007FF721834000-memory.dmp	upx
behavioral2/files/0x0007000000023402-154.dat	upx
behavioral2/files/0x0007000000023401-152.dat	upx
behavioral2/files/0x0007000000023400-150.dat	upx
behavioral2/files/0x00070000000233fe-148.dat	upx
behavioral2/memory/2852-144-0x00007FF6EC920000-0x00007FF6ECC74000-memory.dmp	upx
behavioral2/memory/4148-143-0x00007FF6EAFA0000-0x00007FF6EB2F4000-memory.dmp	upx
behavioral2/files/0x00070000000233fd-137.dat	upx
behavioral2/files/0x00070000000233ff-134.dat	upx
behavioral2/files/0x00070000000233fc-133.dat	upx
behavioral2/memory/3892-124-0x00007FF705180000-0x00007FF7054D4000-memory.dmp	upx
behavioral2/files/0x00070000000233fa-115.dat	upx
behavioral2/files/0x00070000000233f9-114.dat	upx
behavioral2/files/0x00070000000233f8-113.dat	upx
behavioral2/files/0x00070000000233f7-103.dat	upx
behavioral2/memory/1700-95-0x00007FF638170000-0x00007FF6384C4000-memory.dmp	upx
behavioral2/files/0x0007000000023407-185.dat	upx
behavioral2/files/0x0007000000023408-190.dat	upx
behavioral2/files/0x0007000000023405-180.dat	upx
behavioral2/files/0x00070000000233f5-94.dat	upx
behavioral2/files/0x00070000000233f4-88.dat	upx
behavioral2/files/0x00070000000233f3-86.dat	upx
behavioral2/files/0x00070000000233ee-73.dat	upx
behavioral2/files/0x00070000000233f1-71.dat	upx
behavioral2/memory/5088-64-0x00007FF756A90000-0x00007FF756DE4000-memory.dmp	upx
behavioral2/files/0x00070000000233ef-54.dat	upx
behavioral2/memory/1620-49-0x00007FF66CAD0000-0x00007FF66CE24000-memory.dmp	upx
behavioral2/memory/3404-47-0x00007FF7BCAF0000-0x00007FF7BCE44000-memory.dmp	upx
behavioral2/files/0x00070000000233ed-33.dat	upx
behavioral2/memory/724-37-0x00007FF660F40000-0x00007FF661294000-memory.dmp	upx
behavioral2/memory/64-22-0x00007FF7BAEE0000-0x00007FF7BB234000-memory.dmp	upx
behavioral2/files/0x00080000000233e6-15.dat	upx
behavioral2/memory/4328-9-0x00007FF795090000-0x00007FF7953E4000-memory.dmp	upx
behavioral2/memory/4328-2124-0x00007FF795090000-0x00007FF7953E4000-memory.dmp	upx
behavioral2/memory/724-2125-0x00007FF660F40000-0x00007FF661294000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zjVWmRJ.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\AOevcBH.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\FhFAYQz.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\bhtVBaV.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\bRkKUAq.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\XotvSyH.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\VwaiRcB.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\alTiXOv.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\sjoZpLo.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\sfAjWoU.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\mOzuifd.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\FtqEIDQ.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\pjDUNlP.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\JAtGBPX.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\PlARlla.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\MGiHAtU.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\wPPCMkw.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\VBBQJwn.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\BJAMihh.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\JJuOdoF.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\GiLPxdf.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\UcvFMXZ.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\jeqEpKW.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\GKuCepz.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\WMotHGx.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\haPrUDZ.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\QiKCldL.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\GIKKuva.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\UyQRmWB.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\dRihvjC.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\gyHflKk.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\hOtHmxm.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\vhmBAFx.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\VzSUufl.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\kLTNTMI.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\QkaUEcd.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\iKhczKu.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\ciSjuJv.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\TURmxAH.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\NfTwnAu.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\HHvNGha.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\SbaAHHG.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\XxKaWgk.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\hqYIkgw.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\wmOzHaL.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\BYHkmMJ.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\FfhxfuG.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\eARQvis.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\ZeVgDDW.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\mrBcJpS.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\xCmktYC.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\VYaUXgZ.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\GQzoadZ.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\KpCyKWL.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\jbQaahS.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\aqvEzhq.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\HsCuvJa.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\fBcttHP.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\pqZzXYw.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\nvjPtVy.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\lwcCJXL.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\YIGcHzM.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\xmwCGiC.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
File created	C:\Windows\System\tcSUBeD.exe	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4328	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	83
PID 4324 wrote to memory of 4328	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	83
PID 4324 wrote to memory of 64	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	84
PID 4324 wrote to memory of 64	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	84
PID 4324 wrote to memory of 724	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	85
PID 4324 wrote to memory of 724	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	85
PID 4324 wrote to memory of 3636	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	86
PID 4324 wrote to memory of 3636	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	86
PID 4324 wrote to memory of 3404	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	87
PID 4324 wrote to memory of 3404	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	87
PID 4324 wrote to memory of 1620	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	88
PID 4324 wrote to memory of 1620	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	88
PID 4324 wrote to memory of 2012	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	89
PID 4324 wrote to memory of 2012	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	89
PID 4324 wrote to memory of 5088	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	90
PID 4324 wrote to memory of 5088	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	90
PID 4324 wrote to memory of 1504	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	91
PID 4324 wrote to memory of 1504	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	91
PID 4324 wrote to memory of 1700	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	92
PID 4324 wrote to memory of 1700	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	92
PID 4324 wrote to memory of 1960	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	93
PID 4324 wrote to memory of 1960	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	93
PID 4324 wrote to memory of 3504	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	94
PID 4324 wrote to memory of 3504	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	94
PID 4324 wrote to memory of 3892	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	95
PID 4324 wrote to memory of 3892	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	95
PID 4324 wrote to memory of 1880	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	96
PID 4324 wrote to memory of 1880	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	96
PID 4324 wrote to memory of 4148	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	97
PID 4324 wrote to memory of 4148	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	97
PID 4324 wrote to memory of 2852	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	98
PID 4324 wrote to memory of 2852	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	98
PID 4324 wrote to memory of 4056	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	99
PID 4324 wrote to memory of 4056	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	99
PID 4324 wrote to memory of 3308	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	100
PID 4324 wrote to memory of 3308	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	100
PID 4324 wrote to memory of 1068	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	101
PID 4324 wrote to memory of 1068	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	101
PID 4324 wrote to memory of 3256	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	102
PID 4324 wrote to memory of 3256	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	102
PID 4324 wrote to memory of 2564	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	103
PID 4324 wrote to memory of 2564	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	103
PID 4324 wrote to memory of 4900	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	104
PID 4324 wrote to memory of 4900	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	104
PID 4324 wrote to memory of 4776	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	105
PID 4324 wrote to memory of 4776	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	105
PID 4324 wrote to memory of 400	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	106
PID 4324 wrote to memory of 400	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	106
PID 4324 wrote to memory of 2800	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	107
PID 4324 wrote to memory of 2800	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	107
PID 4324 wrote to memory of 4204	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	108
PID 4324 wrote to memory of 4204	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	108
PID 4324 wrote to memory of 3792	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	109
PID 4324 wrote to memory of 3792	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	109
PID 4324 wrote to memory of 2424	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	110
PID 4324 wrote to memory of 2424	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	110
PID 4324 wrote to memory of 4260	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	111
PID 4324 wrote to memory of 4260	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	111
PID 4324 wrote to memory of 4720	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	112
PID 4324 wrote to memory of 4720	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	112
PID 4324 wrote to memory of 3828	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	113
PID 4324 wrote to memory of 3828	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	113
PID 4324 wrote to memory of 2072	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	114
PID 4324 wrote to memory of 2072	4324	5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5b9380a6d75888299500588afbe2fa60_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\System\ePfMPLp.exe
  C:\Windows\System\ePfMPLp.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\RrjGFHV.exe
  C:\Windows\System\RrjGFHV.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\MvyiKOk.exe
  C:\Windows\System\MvyiKOk.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\FhFAYQz.exe
  C:\Windows\System\FhFAYQz.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\DTluPQZ.exe
  C:\Windows\System\DTluPQZ.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\BMwNlRz.exe
  C:\Windows\System\BMwNlRz.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\bGRDRqT.exe
  C:\Windows\System\bGRDRqT.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\gIijHGm.exe
  C:\Windows\System\gIijHGm.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\PDLNWjZ.exe
  C:\Windows\System\PDLNWjZ.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\Unqsjrl.exe
  C:\Windows\System\Unqsjrl.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\IkosEYN.exe
  C:\Windows\System\IkosEYN.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\udPhBFa.exe
  C:\Windows\System\udPhBFa.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\jsJyosj.exe
  C:\Windows\System\jsJyosj.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\INvHirY.exe
  C:\Windows\System\INvHirY.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\knQOEYk.exe
  C:\Windows\System\knQOEYk.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\wWLfiru.exe
  C:\Windows\System\wWLfiru.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\KXwGWOE.exe
  C:\Windows\System\KXwGWOE.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\FXmrmvL.exe
  C:\Windows\System\FXmrmvL.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\iKhczKu.exe
  C:\Windows\System\iKhczKu.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\RpTqSoi.exe
  C:\Windows\System\RpTqSoi.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\YIGcHzM.exe
  C:\Windows\System\YIGcHzM.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\haPrUDZ.exe
  C:\Windows\System\haPrUDZ.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\wmOzHaL.exe
  C:\Windows\System\wmOzHaL.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\qdxUpCA.exe
  C:\Windows\System\qdxUpCA.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\DgQbSkJ.exe
  C:\Windows\System\DgQbSkJ.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\FGvWbFS.exe
  C:\Windows\System\FGvWbFS.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\YfHvHhb.exe
  C:\Windows\System\YfHvHhb.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\tVGNCBG.exe
  C:\Windows\System\tVGNCBG.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\aexBxwA.exe
  C:\Windows\System\aexBxwA.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\wnzDOfm.exe
  C:\Windows\System\wnzDOfm.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\iysQpeg.exe
  C:\Windows\System\iysQpeg.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\NgesGgL.exe
  C:\Windows\System\NgesGgL.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\mSGMVKI.exe
  C:\Windows\System\mSGMVKI.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\pkfYhtM.exe
  C:\Windows\System\pkfYhtM.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\OdFLgCH.exe
  C:\Windows\System\OdFLgCH.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\PeMgjEa.exe
  C:\Windows\System\PeMgjEa.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\nJFAyqm.exe
  C:\Windows\System\nJFAyqm.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\guJBWlQ.exe
  C:\Windows\System\guJBWlQ.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\aqvEzhq.exe
  C:\Windows\System\aqvEzhq.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\nRlGrVs.exe
  C:\Windows\System\nRlGrVs.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\RUdOUsX.exe
  C:\Windows\System\RUdOUsX.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\XbwFCJj.exe
  C:\Windows\System\XbwFCJj.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\bGMxhDe.exe
  C:\Windows\System\bGMxhDe.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\jLeklKr.exe
  C:\Windows\System\jLeklKr.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\ZlLWjXa.exe
  C:\Windows\System\ZlLWjXa.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\HNAUohR.exe
  C:\Windows\System\HNAUohR.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\eTrjfve.exe
  C:\Windows\System\eTrjfve.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\RConzni.exe
  C:\Windows\System\RConzni.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\Zgftiss.exe
  C:\Windows\System\Zgftiss.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\iHLDnxn.exe
  C:\Windows\System\iHLDnxn.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\brmZOik.exe
  C:\Windows\System\brmZOik.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\DUcHMPH.exe
  C:\Windows\System\DUcHMPH.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\wEcPXzk.exe
  C:\Windows\System\wEcPXzk.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\MizmzNo.exe
  C:\Windows\System\MizmzNo.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\BYHkmMJ.exe
  C:\Windows\System\BYHkmMJ.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\PlARlla.exe
  C:\Windows\System\PlARlla.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\thrXiLM.exe
  C:\Windows\System\thrXiLM.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\mXhMTpB.exe
  C:\Windows\System\mXhMTpB.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\yqpNJmu.exe
  C:\Windows\System\yqpNJmu.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\PqBewDv.exe
  C:\Windows\System\PqBewDv.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\tZjsULY.exe
  C:\Windows\System\tZjsULY.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\FtHZAHW.exe
  C:\Windows\System\FtHZAHW.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\wXHAmjf.exe
  C:\Windows\System\wXHAmjf.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\RhVKMfm.exe
  C:\Windows\System\RhVKMfm.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\yBCMIUi.exe
  C:\Windows\System\yBCMIUi.exe
  2⤵
  PID:4828
- C:\Windows\System\FAghPrK.exe
  C:\Windows\System\FAghPrK.exe
  2⤵
  PID:4824
- C:\Windows\System\hISjeWK.exe
  C:\Windows\System\hISjeWK.exe
  2⤵
  PID:3136
- C:\Windows\System\RGGwDKD.exe
  C:\Windows\System\RGGwDKD.exe
  2⤵
  PID:2924
- C:\Windows\System\DgtGJGh.exe
  C:\Windows\System\DgtGJGh.exe
  2⤵
  PID:4652
- C:\Windows\System\kdbpcOI.exe
  C:\Windows\System\kdbpcOI.exe
  2⤵
  PID:3508
- C:\Windows\System\cmhkItf.exe
  C:\Windows\System\cmhkItf.exe
  2⤵
  PID:4344
- C:\Windows\System\xmwCGiC.exe
  C:\Windows\System\xmwCGiC.exe
  2⤵
  PID:5012
- C:\Windows\System\UyGxvtX.exe
  C:\Windows\System\UyGxvtX.exe
  2⤵
  PID:4528
- C:\Windows\System\nCQtwtP.exe
  C:\Windows\System\nCQtwtP.exe
  2⤵
  PID:3228
- C:\Windows\System\edWHTOV.exe
  C:\Windows\System\edWHTOV.exe
  2⤵
  PID:3856
- C:\Windows\System\AmpxdwI.exe
  C:\Windows\System\AmpxdwI.exe
  2⤵
  PID:4236
- C:\Windows\System\jhSwMnk.exe
  C:\Windows\System\jhSwMnk.exe
  2⤵
  PID:1684
- C:\Windows\System\fJsPEtJ.exe
  C:\Windows\System\fJsPEtJ.exe
  2⤵
  PID:1912
- C:\Windows\System\bhtVBaV.exe
  C:\Windows\System\bhtVBaV.exe
  2⤵
  PID:2912
- C:\Windows\System\UUAqWQq.exe
  C:\Windows\System\UUAqWQq.exe
  2⤵
  PID:1312
- C:\Windows\System\euBXpiN.exe
  C:\Windows\System\euBXpiN.exe
  2⤵
  PID:1896
- C:\Windows\System\mPbQfVI.exe
  C:\Windows\System\mPbQfVI.exe
  2⤵
  PID:1904
- C:\Windows\System\HsCuvJa.exe
  C:\Windows\System\HsCuvJa.exe
  2⤵
  PID:2184
- C:\Windows\System\fBcttHP.exe
  C:\Windows\System\fBcttHP.exe
  2⤵
  PID:1944
- C:\Windows\System\VDMmqtj.exe
  C:\Windows\System\VDMmqtj.exe
  2⤵
  PID:2836
- C:\Windows\System\QULsRbe.exe
  C:\Windows\System\QULsRbe.exe
  2⤵
  PID:2336
- C:\Windows\System\WPpGJRy.exe
  C:\Windows\System\WPpGJRy.exe
  2⤵
  PID:4200
- C:\Windows\System\oLKJhUT.exe
  C:\Windows\System\oLKJhUT.exe
  2⤵
  PID:5132
- C:\Windows\System\SQGRlOj.exe
  C:\Windows\System\SQGRlOj.exe
  2⤵
  PID:5208
- C:\Windows\System\KVMUXuJ.exe
  C:\Windows\System\KVMUXuJ.exe
  2⤵
  PID:5236
- C:\Windows\System\BoNTNBE.exe
  C:\Windows\System\BoNTNBE.exe
  2⤵
  PID:5264
- C:\Windows\System\NbUvxUb.exe
  C:\Windows\System\NbUvxUb.exe
  2⤵
  PID:5296
- C:\Windows\System\rxtDPhB.exe
  C:\Windows\System\rxtDPhB.exe
  2⤵
  PID:5316
- C:\Windows\System\NJfhCNi.exe
  C:\Windows\System\NJfhCNi.exe
  2⤵
  PID:5352
- C:\Windows\System\nMsUTeI.exe
  C:\Windows\System\nMsUTeI.exe
  2⤵
  PID:5380
- C:\Windows\System\FfhxfuG.exe
  C:\Windows\System\FfhxfuG.exe
  2⤵
  PID:5400
- C:\Windows\System\lAPAoLG.exe
  C:\Windows\System\lAPAoLG.exe
  2⤵
  PID:5432
- C:\Windows\System\xiovauS.exe
  C:\Windows\System\xiovauS.exe
  2⤵
  PID:5464
- C:\Windows\System\dBcgOjS.exe
  C:\Windows\System\dBcgOjS.exe
  2⤵
  PID:5492
- C:\Windows\System\bykJriy.exe
  C:\Windows\System\bykJriy.exe
  2⤵
  PID:5520
- C:\Windows\System\KcaaYnh.exe
  C:\Windows\System\KcaaYnh.exe
  2⤵
  PID:5548
- C:\Windows\System\TLmpzuZ.exe
  C:\Windows\System\TLmpzuZ.exe
  2⤵
  PID:5580
- C:\Windows\System\xvPWFZX.exe
  C:\Windows\System\xvPWFZX.exe
  2⤵
  PID:5604
- C:\Windows\System\ZQWJkSV.exe
  C:\Windows\System\ZQWJkSV.exe
  2⤵
  PID:5636
- C:\Windows\System\QMlJYsi.exe
  C:\Windows\System\QMlJYsi.exe
  2⤵
  PID:5656
- C:\Windows\System\FcMtrjz.exe
  C:\Windows\System\FcMtrjz.exe
  2⤵
  PID:5676
- C:\Windows\System\tOAfFAR.exe
  C:\Windows\System\tOAfFAR.exe
  2⤵
  PID:5712
- C:\Windows\System\UlVqFOO.exe
  C:\Windows\System\UlVqFOO.exe
  2⤵
  PID:5748
- C:\Windows\System\KaINeLM.exe
  C:\Windows\System\KaINeLM.exe
  2⤵
  PID:5784
- C:\Windows\System\QiKCldL.exe
  C:\Windows\System\QiKCldL.exe
  2⤵
  PID:5812
- C:\Windows\System\eEzNZhg.exe
  C:\Windows\System\eEzNZhg.exe
  2⤵
  PID:5848
- C:\Windows\System\ctXlzOZ.exe
  C:\Windows\System\ctXlzOZ.exe
  2⤵
  PID:5876
- C:\Windows\System\mOzuifd.exe
  C:\Windows\System\mOzuifd.exe
  2⤵
  PID:5904
- C:\Windows\System\BsHOunp.exe
  C:\Windows\System\BsHOunp.exe
  2⤵
  PID:5932
- C:\Windows\System\FtqEIDQ.exe
  C:\Windows\System\FtqEIDQ.exe
  2⤵
  PID:5968
- C:\Windows\System\VHkGESk.exe
  C:\Windows\System\VHkGESk.exe
  2⤵
  PID:6000
- C:\Windows\System\sZAQPZt.exe
  C:\Windows\System\sZAQPZt.exe
  2⤵
  PID:6028
- C:\Windows\System\zvnwOhP.exe
  C:\Windows\System\zvnwOhP.exe
  2⤵
  PID:6044
- C:\Windows\System\NfTwnAu.exe
  C:\Windows\System\NfTwnAu.exe
  2⤵
  PID:6080
- C:\Windows\System\izBHrUu.exe
  C:\Windows\System\izBHrUu.exe
  2⤵
  PID:6112
- C:\Windows\System\SGmTVOz.exe
  C:\Windows\System\SGmTVOz.exe
  2⤵
  PID:3336
- C:\Windows\System\fnhpnpK.exe
  C:\Windows\System\fnhpnpK.exe
  2⤵
  PID:3092
- C:\Windows\System\WSsMMWp.exe
  C:\Windows\System\WSsMMWp.exe
  2⤵
  PID:5272
- C:\Windows\System\FBkdHIW.exe
  C:\Windows\System\FBkdHIW.exe
  2⤵
  PID:5280
- C:\Windows\System\QtLKtJO.exe
  C:\Windows\System\QtLKtJO.exe
  2⤵
  PID:5368
- C:\Windows\System\szkcgbs.exe
  C:\Windows\System\szkcgbs.exe
  2⤵
  PID:5440
- C:\Windows\System\RZWbmMT.exe
  C:\Windows\System\RZWbmMT.exe
  2⤵
  PID:5476
- C:\Windows\System\UqKCxjr.exe
  C:\Windows\System\UqKCxjr.exe
  2⤵
  PID:5540
- C:\Windows\System\pWOUIgH.exe
  C:\Windows\System\pWOUIgH.exe
  2⤵
  PID:5620
- C:\Windows\System\LZiUupp.exe
  C:\Windows\System\LZiUupp.exe
  2⤵
  PID:5692
- C:\Windows\System\ldxEjod.exe
  C:\Windows\System\ldxEjod.exe
  2⤵
  PID:5760
- C:\Windows\System\tiwUVUf.exe
  C:\Windows\System\tiwUVUf.exe
  2⤵
  PID:868
- C:\Windows\System\mdFjEXT.exe
  C:\Windows\System\mdFjEXT.exe
  2⤵
  PID:5864
- C:\Windows\System\Okqhqoh.exe
  C:\Windows\System\Okqhqoh.exe
  2⤵
  PID:5956
- C:\Windows\System\VzSUufl.exe
  C:\Windows\System\VzSUufl.exe
  2⤵
  PID:6024
- C:\Windows\System\EVBBBlg.exe
  C:\Windows\System\EVBBBlg.exe
  2⤵
  PID:6064
- C:\Windows\System\BvCVOqY.exe
  C:\Windows\System\BvCVOqY.exe
  2⤵
  PID:6140
- C:\Windows\System\tcSUBeD.exe
  C:\Windows\System\tcSUBeD.exe
  2⤵
  PID:2192
- C:\Windows\System\jjbMLOe.exe
  C:\Windows\System\jjbMLOe.exe
  2⤵
  PID:5344
- C:\Windows\System\XVBVQaR.exe
  C:\Windows\System\XVBVQaR.exe
  2⤵
  PID:5532
- C:\Windows\System\KVPQRYX.exe
  C:\Windows\System\KVPQRYX.exe
  2⤵
  PID:4480
- C:\Windows\System\CrraQvV.exe
  C:\Windows\System\CrraQvV.exe
  2⤵
  PID:5860
- C:\Windows\System\sQZnsMy.exe
  C:\Windows\System\sQZnsMy.exe
  2⤵
  PID:6056
- C:\Windows\System\qhlPyGn.exe
  C:\Windows\System\qhlPyGn.exe
  2⤵
  PID:5288
- C:\Windows\System\rAQPLdt.exe
  C:\Windows\System\rAQPLdt.exe
  2⤵
  PID:5672
- C:\Windows\System\qcjbwYa.exe
  C:\Windows\System\qcjbwYa.exe
  2⤵
  PID:6012
- C:\Windows\System\CKKeoXL.exe
  C:\Windows\System\CKKeoXL.exe
  2⤵
  PID:5456
- C:\Windows\System\ePfkmmk.exe
  C:\Windows\System\ePfkmmk.exe
  2⤵
  PID:5828
- C:\Windows\System\EKKqKKH.exe
  C:\Windows\System\EKKqKKH.exe
  2⤵
  PID:6172
- C:\Windows\System\gUCZlsV.exe
  C:\Windows\System\gUCZlsV.exe
  2⤵
  PID:6200
- C:\Windows\System\emCAaHJ.exe
  C:\Windows\System\emCAaHJ.exe
  2⤵
  PID:6228
- C:\Windows\System\hAqgDEQ.exe
  C:\Windows\System\hAqgDEQ.exe
  2⤵
  PID:6256
- C:\Windows\System\JTSXUwA.exe
  C:\Windows\System\JTSXUwA.exe
  2⤵
  PID:6284
- C:\Windows\System\mjaDDtN.exe
  C:\Windows\System\mjaDDtN.exe
  2⤵
  PID:6312
- C:\Windows\System\xCmktYC.exe
  C:\Windows\System\xCmktYC.exe
  2⤵
  PID:6340
- C:\Windows\System\yojcOyI.exe
  C:\Windows\System\yojcOyI.exe
  2⤵
  PID:6368
- C:\Windows\System\UBsRSQb.exe
  C:\Windows\System\UBsRSQb.exe
  2⤵
  PID:6396
- C:\Windows\System\GIKKuva.exe
  C:\Windows\System\GIKKuva.exe
  2⤵
  PID:6424
- C:\Windows\System\QVWboPo.exe
  C:\Windows\System\QVWboPo.exe
  2⤵
  PID:6452
- C:\Windows\System\HPMMUJV.exe
  C:\Windows\System\HPMMUJV.exe
  2⤵
  PID:6480
- C:\Windows\System\aMurpfH.exe
  C:\Windows\System\aMurpfH.exe
  2⤵
  PID:6508
- C:\Windows\System\xvRPvFC.exe
  C:\Windows\System\xvRPvFC.exe
  2⤵
  PID:6532
- C:\Windows\System\afcTRKP.exe
  C:\Windows\System\afcTRKP.exe
  2⤵
  PID:6560
- C:\Windows\System\PJloPot.exe
  C:\Windows\System\PJloPot.exe
  2⤵
  PID:6600
- C:\Windows\System\UbsufWu.exe
  C:\Windows\System\UbsufWu.exe
  2⤵
  PID:6632
- C:\Windows\System\uZRdCcy.exe
  C:\Windows\System\uZRdCcy.exe
  2⤵
  PID:6664
- C:\Windows\System\gieMnqo.exe
  C:\Windows\System\gieMnqo.exe
  2⤵
  PID:6688
- C:\Windows\System\hWrZNGX.exe
  C:\Windows\System\hWrZNGX.exe
  2⤵
  PID:6716
- C:\Windows\System\YeaSLkV.exe
  C:\Windows\System\YeaSLkV.exe
  2⤵
  PID:6744
- C:\Windows\System\aAfPYfm.exe
  C:\Windows\System\aAfPYfm.exe
  2⤵
  PID:6772
- C:\Windows\System\NKLbKrt.exe
  C:\Windows\System\NKLbKrt.exe
  2⤵
  PID:6804
- C:\Windows\System\pFCnbDB.exe
  C:\Windows\System\pFCnbDB.exe
  2⤵
  PID:6828
- C:\Windows\System\ivwAeCw.exe
  C:\Windows\System\ivwAeCw.exe
  2⤵
  PID:6856
- C:\Windows\System\JJuOdoF.exe
  C:\Windows\System\JJuOdoF.exe
  2⤵
  PID:6888
- C:\Windows\System\PPCXyLM.exe
  C:\Windows\System\PPCXyLM.exe
  2⤵
  PID:6912
- C:\Windows\System\VYaUXgZ.exe
  C:\Windows\System\VYaUXgZ.exe
  2⤵
  PID:6944
- C:\Windows\System\LrkOJzd.exe
  C:\Windows\System\LrkOJzd.exe
  2⤵
  PID:6968
- C:\Windows\System\aoXdqYA.exe
  C:\Windows\System\aoXdqYA.exe
  2⤵
  PID:6996
- C:\Windows\System\ObGUPWi.exe
  C:\Windows\System\ObGUPWi.exe
  2⤵
  PID:7024
- C:\Windows\System\pMNcXtE.exe
  C:\Windows\System\pMNcXtE.exe
  2⤵
  PID:7052
- C:\Windows\System\yqfDDJA.exe
  C:\Windows\System\yqfDDJA.exe
  2⤵
  PID:7080
- C:\Windows\System\UecEvqn.exe
  C:\Windows\System\UecEvqn.exe
  2⤵
  PID:7108
- C:\Windows\System\vPYMLpP.exe
  C:\Windows\System\vPYMLpP.exe
  2⤵
  PID:7144
- C:\Windows\System\gkdPvBE.exe
  C:\Windows\System\gkdPvBE.exe
  2⤵
  PID:7164
- C:\Windows\System\gtuaiuO.exe
  C:\Windows\System\gtuaiuO.exe
  2⤵
  PID:6192
- C:\Windows\System\ewofXMB.exe
  C:\Windows\System\ewofXMB.exe
  2⤵
  PID:6252
- C:\Windows\System\BWHvPQS.exe
  C:\Windows\System\BWHvPQS.exe
  2⤵
  PID:6324
- C:\Windows\System\cbkwkot.exe
  C:\Windows\System\cbkwkot.exe
  2⤵
  PID:6392
- C:\Windows\System\ehatPRh.exe
  C:\Windows\System\ehatPRh.exe
  2⤵
  PID:6448
- C:\Windows\System\EwLmvXy.exe
  C:\Windows\System\EwLmvXy.exe
  2⤵
  PID:6520
- C:\Windows\System\vErCgZH.exe
  C:\Windows\System\vErCgZH.exe
  2⤵
  PID:6584
- C:\Windows\System\OYPjnKx.exe
  C:\Windows\System\OYPjnKx.exe
  2⤵
  PID:6652
- C:\Windows\System\mtYvvRg.exe
  C:\Windows\System\mtYvvRg.exe
  2⤵
  PID:6712
- C:\Windows\System\HHvNGha.exe
  C:\Windows\System\HHvNGha.exe
  2⤵
  PID:6784
- C:\Windows\System\rawMEpf.exe
  C:\Windows\System\rawMEpf.exe
  2⤵
  PID:6848
- C:\Windows\System\ZYcTFOK.exe
  C:\Windows\System\ZYcTFOK.exe
  2⤵
  PID:6908
- C:\Windows\System\bqcGXti.exe
  C:\Windows\System\bqcGXti.exe
  2⤵
  PID:6980
- C:\Windows\System\mlssvOB.exe
  C:\Windows\System\mlssvOB.exe
  2⤵
  PID:7044
- C:\Windows\System\Wbhzjeg.exe
  C:\Windows\System\Wbhzjeg.exe
  2⤵
  PID:7104
- C:\Windows\System\lUCyMij.exe
  C:\Windows\System\lUCyMij.exe
  2⤵
  PID:6168
- C:\Windows\System\jmUXRAJ.exe
  C:\Windows\System\jmUXRAJ.exe
  2⤵
  PID:6296
- C:\Windows\System\lvrwitU.exe
  C:\Windows\System\lvrwitU.exe
  2⤵
  PID:6444
- C:\Windows\System\bRkKUAq.exe
  C:\Windows\System\bRkKUAq.exe
  2⤵
  PID:1924
- C:\Windows\System\ebbceVK.exe
  C:\Windows\System\ebbceVK.exe
  2⤵
  PID:6756
- C:\Windows\System\LeXkDkv.exe
  C:\Windows\System\LeXkDkv.exe
  2⤵
  PID:6896
- C:\Windows\System\KMnsLBg.exe
  C:\Windows\System\KMnsLBg.exe
  2⤵
  PID:7036
- C:\Windows\System\cumdGan.exe
  C:\Windows\System\cumdGan.exe
  2⤵
  PID:6248
- C:\Windows\System\SbaAHHG.exe
  C:\Windows\System\SbaAHHG.exe
  2⤵
  PID:6580
- C:\Windows\System\pbwybZB.exe
  C:\Windows\System\pbwybZB.exe
  2⤵
  PID:6876
- C:\Windows\System\QALfSWS.exe
  C:\Windows\System\QALfSWS.exe
  2⤵
  PID:1408
- C:\Windows\System\IkaCSLy.exe
  C:\Windows\System\IkaCSLy.exe
  2⤵
  PID:7008
- C:\Windows\System\qrvOeJU.exe
  C:\Windows\System\qrvOeJU.exe
  2⤵
  PID:5328
- C:\Windows\System\SJHqLVt.exe
  C:\Windows\System\SJHqLVt.exe
  2⤵
  PID:7192
- C:\Windows\System\pOJMLNR.exe
  C:\Windows\System\pOJMLNR.exe
  2⤵
  PID:7220
- C:\Windows\System\lkZxdmz.exe
  C:\Windows\System\lkZxdmz.exe
  2⤵
  PID:7248
- C:\Windows\System\IWeEAmz.exe
  C:\Windows\System\IWeEAmz.exe
  2⤵
  PID:7284
- C:\Windows\System\pvLHFOJ.exe
  C:\Windows\System\pvLHFOJ.exe
  2⤵
  PID:7312
- C:\Windows\System\BuvMMGi.exe
  C:\Windows\System\BuvMMGi.exe
  2⤵
  PID:7336
- C:\Windows\System\nYjakRq.exe
  C:\Windows\System\nYjakRq.exe
  2⤵
  PID:7364
- C:\Windows\System\IrUtyJV.exe
  C:\Windows\System\IrUtyJV.exe
  2⤵
  PID:7388
- C:\Windows\System\TdLJWtH.exe
  C:\Windows\System\TdLJWtH.exe
  2⤵
  PID:7420
- C:\Windows\System\YSyGfJe.exe
  C:\Windows\System\YSyGfJe.exe
  2⤵
  PID:7444
- C:\Windows\System\GvBxMAD.exe
  C:\Windows\System\GvBxMAD.exe
  2⤵
  PID:7472
- C:\Windows\System\hqSUOeb.exe
  C:\Windows\System\hqSUOeb.exe
  2⤵
  PID:7500
- C:\Windows\System\SifaRMU.exe
  C:\Windows\System\SifaRMU.exe
  2⤵
  PID:7536
- C:\Windows\System\rlCEyGk.exe
  C:\Windows\System\rlCEyGk.exe
  2⤵
  PID:7560
- C:\Windows\System\ecPiVMN.exe
  C:\Windows\System\ecPiVMN.exe
  2⤵
  PID:7584
- C:\Windows\System\sykvUiw.exe
  C:\Windows\System\sykvUiw.exe
  2⤵
  PID:7612
- C:\Windows\System\pqZzXYw.exe
  C:\Windows\System\pqZzXYw.exe
  2⤵
  PID:7640
- C:\Windows\System\KpJvotS.exe
  C:\Windows\System\KpJvotS.exe
  2⤵
  PID:7672
- C:\Windows\System\gfuZejU.exe
  C:\Windows\System\gfuZejU.exe
  2⤵
  PID:7696
- C:\Windows\System\khgDfQf.exe
  C:\Windows\System\khgDfQf.exe
  2⤵
  PID:7724
- C:\Windows\System\AOpaMDs.exe
  C:\Windows\System\AOpaMDs.exe
  2⤵
  PID:7752
- C:\Windows\System\adSlmwm.exe
  C:\Windows\System\adSlmwm.exe
  2⤵
  PID:7780
- C:\Windows\System\YiSnvlj.exe
  C:\Windows\System\YiSnvlj.exe
  2⤵
  PID:7808
- C:\Windows\System\LXpvoQY.exe
  C:\Windows\System\LXpvoQY.exe
  2⤵
  PID:7836
- C:\Windows\System\xHQdaiZ.exe
  C:\Windows\System\xHQdaiZ.exe
  2⤵
  PID:7864
- C:\Windows\System\DnzCTwi.exe
  C:\Windows\System\DnzCTwi.exe
  2⤵
  PID:7892
- C:\Windows\System\snZMtFd.exe
  C:\Windows\System\snZMtFd.exe
  2⤵
  PID:7920
- C:\Windows\System\hwsEdIj.exe
  C:\Windows\System\hwsEdIj.exe
  2⤵
  PID:7948
- C:\Windows\System\pxEtfns.exe
  C:\Windows\System\pxEtfns.exe
  2⤵
  PID:7988
- C:\Windows\System\JtHJyLt.exe
  C:\Windows\System\JtHJyLt.exe
  2⤵
  PID:8024
- C:\Windows\System\dRihvjC.exe
  C:\Windows\System\dRihvjC.exe
  2⤵
  PID:8064
- C:\Windows\System\lgpZlwo.exe
  C:\Windows\System\lgpZlwo.exe
  2⤵
  PID:8096
- C:\Windows\System\HPCuwvN.exe
  C:\Windows\System\HPCuwvN.exe
  2⤵
  PID:8124
- C:\Windows\System\YHPzuvW.exe
  C:\Windows\System\YHPzuvW.exe
  2⤵
  PID:8152
- C:\Windows\System\ZpECVCX.exe
  C:\Windows\System\ZpECVCX.exe
  2⤵
  PID:8180
- C:\Windows\System\NCBrnIf.exe
  C:\Windows\System\NCBrnIf.exe
  2⤵
  PID:7212
- C:\Windows\System\OjQYyKZ.exe
  C:\Windows\System\OjQYyKZ.exe
  2⤵
  PID:7268
- C:\Windows\System\ARjqMMR.exe
  C:\Windows\System\ARjqMMR.exe
  2⤵
  PID:7328
- C:\Windows\System\PxOQMkV.exe
  C:\Windows\System\PxOQMkV.exe
  2⤵
  PID:7408
- C:\Windows\System\AXaSbBI.exe
  C:\Windows\System\AXaSbBI.exe
  2⤵
  PID:3452
- C:\Windows\System\Kllhhrl.exe
  C:\Windows\System\Kllhhrl.exe
  2⤵
  PID:7512
- C:\Windows\System\kPUYEvP.exe
  C:\Windows\System\kPUYEvP.exe
  2⤵
  PID:7576
- C:\Windows\System\ylVcpaa.exe
  C:\Windows\System\ylVcpaa.exe
  2⤵
  PID:7636
- C:\Windows\System\LivmlSq.exe
  C:\Windows\System\LivmlSq.exe
  2⤵
  PID:7708
- C:\Windows\System\DasogNl.exe
  C:\Windows\System\DasogNl.exe
  2⤵
  PID:7772
- C:\Windows\System\XVPGmQE.exe
  C:\Windows\System\XVPGmQE.exe
  2⤵
  PID:7832
- C:\Windows\System\kTzEGba.exe
  C:\Windows\System\kTzEGba.exe
  2⤵
  PID:7904
- C:\Windows\System\XsadYkB.exe
  C:\Windows\System\XsadYkB.exe
  2⤵
  PID:7980
- C:\Windows\System\yjHNHCr.exe
  C:\Windows\System\yjHNHCr.exe
  2⤵
  PID:2980
- C:\Windows\System\udvWuPV.exe
  C:\Windows\System\udvWuPV.exe
  2⤵
  PID:8120
- C:\Windows\System\IRKyeNG.exe
  C:\Windows\System\IRKyeNG.exe
  2⤵
  PID:8176
- C:\Windows\System\xHiwcBo.exe
  C:\Windows\System\xHiwcBo.exe
  2⤵
  PID:7260
- C:\Windows\System\inwxiyW.exe
  C:\Windows\System\inwxiyW.exe
  2⤵
  PID:7456
- C:\Windows\System\AegFUGv.exe
  C:\Windows\System\AegFUGv.exe
  2⤵
  PID:7572
- C:\Windows\System\hXMRhJr.exe
  C:\Windows\System\hXMRhJr.exe
  2⤵
  PID:7744
- C:\Windows\System\iWKFigz.exe
  C:\Windows\System\iWKFigz.exe
  2⤵
  PID:7820
- C:\Windows\System\fvfZhdV.exe
  C:\Windows\System\fvfZhdV.exe
  2⤵
  PID:8048
- C:\Windows\System\yKdFNzX.exe
  C:\Windows\System\yKdFNzX.exe
  2⤵
  PID:7240
- C:\Windows\System\aOYlHMb.exe
  C:\Windows\System\aOYlHMb.exe
  2⤵
  PID:7428
- C:\Windows\System\OtivcOL.exe
  C:\Windows\System\OtivcOL.exe
  2⤵
  PID:7692
- C:\Windows\System\XlCdCQg.exe
  C:\Windows\System\XlCdCQg.exe
  2⤵
  PID:8088
- C:\Windows\System\xRucJCs.exe
  C:\Windows\System\xRucJCs.exe
  2⤵
  PID:7688
- C:\Windows\System\pyyzkte.exe
  C:\Windows\System\pyyzkte.exe
  2⤵
  PID:8200
- C:\Windows\System\OGOXBQY.exe
  C:\Windows\System\OGOXBQY.exe
  2⤵
  PID:8228
- C:\Windows\System\eQAQwKA.exe
  C:\Windows\System\eQAQwKA.exe
  2⤵
  PID:8264
- C:\Windows\System\imbjYRX.exe
  C:\Windows\System\imbjYRX.exe
  2⤵
  PID:8304
- C:\Windows\System\CzdJfFx.exe
  C:\Windows\System\CzdJfFx.exe
  2⤵
  PID:8336
- C:\Windows\System\CgdtnjH.exe
  C:\Windows\System\CgdtnjH.exe
  2⤵
  PID:8368
- C:\Windows\System\uBKfUAW.exe
  C:\Windows\System\uBKfUAW.exe
  2⤵
  PID:8400
- C:\Windows\System\TdYtZle.exe
  C:\Windows\System\TdYtZle.exe
  2⤵
  PID:8428
- C:\Windows\System\IybSVgz.exe
  C:\Windows\System\IybSVgz.exe
  2⤵
  PID:8456
- C:\Windows\System\eAPUNYm.exe
  C:\Windows\System\eAPUNYm.exe
  2⤵
  PID:8484
- C:\Windows\System\MtGBLMc.exe
  C:\Windows\System\MtGBLMc.exe
  2⤵
  PID:8512
- C:\Windows\System\jqfFADR.exe
  C:\Windows\System\jqfFADR.exe
  2⤵
  PID:8544
- C:\Windows\System\hnqCflj.exe
  C:\Windows\System\hnqCflj.exe
  2⤵
  PID:8576
- C:\Windows\System\JKZJhmO.exe
  C:\Windows\System\JKZJhmO.exe
  2⤵
  PID:8596
- C:\Windows\System\MGiHAtU.exe
  C:\Windows\System\MGiHAtU.exe
  2⤵
  PID:8640
- C:\Windows\System\LmPrMSn.exe
  C:\Windows\System\LmPrMSn.exe
  2⤵
  PID:8664
- C:\Windows\System\UhZzhzJ.exe
  C:\Windows\System\UhZzhzJ.exe
  2⤵
  PID:8688
- C:\Windows\System\VBBQJwn.exe
  C:\Windows\System\VBBQJwn.exe
  2⤵
  PID:8716
- C:\Windows\System\ghWNfXM.exe
  C:\Windows\System\ghWNfXM.exe
  2⤵
  PID:8748
- C:\Windows\System\iQLxdLe.exe
  C:\Windows\System\iQLxdLe.exe
  2⤵
  PID:8772
- C:\Windows\System\gSDxVcc.exe
  C:\Windows\System\gSDxVcc.exe
  2⤵
  PID:8804
- C:\Windows\System\RUhBRMh.exe
  C:\Windows\System\RUhBRMh.exe
  2⤵
  PID:8828
- C:\Windows\System\ZENRwnb.exe
  C:\Windows\System\ZENRwnb.exe
  2⤵
  PID:8860
- C:\Windows\System\gytZFIf.exe
  C:\Windows\System\gytZFIf.exe
  2⤵
  PID:8892
- C:\Windows\System\lOYBgsr.exe
  C:\Windows\System\lOYBgsr.exe
  2⤵
  PID:8912
- C:\Windows\System\FwRKPVy.exe
  C:\Windows\System\FwRKPVy.exe
  2⤵
  PID:8948
- C:\Windows\System\SALzWto.exe
  C:\Windows\System\SALzWto.exe
  2⤵
  PID:8968
- C:\Windows\System\SiWlAJH.exe
  C:\Windows\System\SiWlAJH.exe
  2⤵
  PID:8996
- C:\Windows\System\ayXEArR.exe
  C:\Windows\System\ayXEArR.exe
  2⤵
  PID:9028
- C:\Windows\System\QsChyyC.exe
  C:\Windows\System\QsChyyC.exe
  2⤵
  PID:9056
- C:\Windows\System\EWQDHWr.exe
  C:\Windows\System\EWQDHWr.exe
  2⤵
  PID:9084
- C:\Windows\System\kpmfrww.exe
  C:\Windows\System\kpmfrww.exe
  2⤵
  PID:9116
- C:\Windows\System\bzePYib.exe
  C:\Windows\System\bzePYib.exe
  2⤵
  PID:9144
- C:\Windows\System\SFOetAI.exe
  C:\Windows\System\SFOetAI.exe
  2⤵
  PID:9172
- C:\Windows\System\rYByGrP.exe
  C:\Windows\System\rYByGrP.exe
  2⤵
  PID:9200
- C:\Windows\System\SODVAsZ.exe
  C:\Windows\System\SODVAsZ.exe
  2⤵
  PID:7552
- C:\Windows\System\QeYgjHG.exe
  C:\Windows\System\QeYgjHG.exe
  2⤵
  PID:1616
- C:\Windows\System\QQYRIug.exe
  C:\Windows\System\QQYRIug.exe
  2⤵
  PID:8316
- C:\Windows\System\xCMNlOk.exe
  C:\Windows\System\xCMNlOk.exe
  2⤵
  PID:8384
- C:\Windows\System\BSldePX.exe
  C:\Windows\System\BSldePX.exe
  2⤵
  PID:8448
- C:\Windows\System\nqoGkit.exe
  C:\Windows\System\nqoGkit.exe
  2⤵
  PID:8508
- C:\Windows\System\RVSLRem.exe
  C:\Windows\System\RVSLRem.exe
  2⤵
  PID:8584
- C:\Windows\System\dVPGQLI.exe
  C:\Windows\System\dVPGQLI.exe
  2⤵
  PID:8652
- C:\Windows\System\dcWAQfM.exe
  C:\Windows\System\dcWAQfM.exe
  2⤵
  PID:8712
- C:\Windows\System\JhlhBnh.exe
  C:\Windows\System\JhlhBnh.exe
  2⤵
  PID:8768
- C:\Windows\System\aIfFIZE.exe
  C:\Windows\System\aIfFIZE.exe
  2⤵
  PID:8840
- C:\Windows\System\tVRNASt.exe
  C:\Windows\System\tVRNASt.exe
  2⤵
  PID:8908
- C:\Windows\System\xukRjgM.exe
  C:\Windows\System\xukRjgM.exe
  2⤵
  PID:8988
- C:\Windows\System\kJNlxwC.exe
  C:\Windows\System\kJNlxwC.exe
  2⤵
  PID:9048
- C:\Windows\System\cudjmWX.exe
  C:\Windows\System\cudjmWX.exe
  2⤵
  PID:9112
- C:\Windows\System\hgiSUMi.exe
  C:\Windows\System\hgiSUMi.exe
  2⤵
  PID:9192
- C:\Windows\System\ausLQFV.exe
  C:\Windows\System\ausLQFV.exe
  2⤵
  PID:8260
- C:\Windows\System\XpAnowL.exe
  C:\Windows\System\XpAnowL.exe
  2⤵
  PID:8360
- C:\Windows\System\EWLeVuK.exe
  C:\Windows\System\EWLeVuK.exe
  2⤵
  PID:8536
- C:\Windows\System\BKhOhse.exe
  C:\Windows\System\BKhOhse.exe
  2⤵
  PID:8680
- C:\Windows\System\NxAMnlb.exe
  C:\Windows\System\NxAMnlb.exe
  2⤵
  PID:8812
- C:\Windows\System\apYZXwB.exe
  C:\Windows\System\apYZXwB.exe
  2⤵
  PID:8980
- C:\Windows\System\bwbahLX.exe
  C:\Windows\System\bwbahLX.exe
  2⤵
  PID:9164
- C:\Windows\System\FYyQApd.exe
  C:\Windows\System\FYyQApd.exe
  2⤵
  PID:8344
- C:\Windows\System\DzBFaZC.exe
  C:\Windows\System\DzBFaZC.exe
  2⤵
  PID:8820
- C:\Windows\System\QAJxzeL.exe
  C:\Windows\System\QAJxzeL.exe
  2⤵
  PID:7828
- C:\Windows\System\XSiPTvR.exe
  C:\Windows\System\XSiPTvR.exe
  2⤵
  PID:8904
- C:\Windows\System\esWCTET.exe
  C:\Windows\System\esWCTET.exe
  2⤵
  PID:9076
- C:\Windows\System\lGGesEw.exe
  C:\Windows\System\lGGesEw.exe
  2⤵
  PID:9236
- C:\Windows\System\cxhSXxU.exe
  C:\Windows\System\cxhSXxU.exe
  2⤵
  PID:9264
- C:\Windows\System\HipnPnD.exe
  C:\Windows\System\HipnPnD.exe
  2⤵
  PID:9292
- C:\Windows\System\NEtLCVB.exe
  C:\Windows\System\NEtLCVB.exe
  2⤵
  PID:9320
- C:\Windows\System\QYCNjyG.exe
  C:\Windows\System\QYCNjyG.exe
  2⤵
  PID:9352
- C:\Windows\System\HtXowYL.exe
  C:\Windows\System\HtXowYL.exe
  2⤵
  PID:9380
- C:\Windows\System\amoDeZJ.exe
  C:\Windows\System\amoDeZJ.exe
  2⤵
  PID:9412
- C:\Windows\System\PuWqOeS.exe
  C:\Windows\System\PuWqOeS.exe
  2⤵
  PID:9436
- C:\Windows\System\nMwjLju.exe
  C:\Windows\System\nMwjLju.exe
  2⤵
  PID:9464
- C:\Windows\System\TcvemZy.exe
  C:\Windows\System\TcvemZy.exe
  2⤵
  PID:9492
- C:\Windows\System\BjbjbLW.exe
  C:\Windows\System\BjbjbLW.exe
  2⤵
  PID:9520
- C:\Windows\System\sdQfgRP.exe
  C:\Windows\System\sdQfgRP.exe
  2⤵
  PID:9548
- C:\Windows\System\uoKPfZw.exe
  C:\Windows\System\uoKPfZw.exe
  2⤵
  PID:9576
- C:\Windows\System\QCxLETt.exe
  C:\Windows\System\QCxLETt.exe
  2⤵
  PID:9604
- C:\Windows\System\LqaXsTb.exe
  C:\Windows\System\LqaXsTb.exe
  2⤵
  PID:9632
- C:\Windows\System\CoabNRo.exe
  C:\Windows\System\CoabNRo.exe
  2⤵
  PID:9660
- C:\Windows\System\DsTmsHQ.exe
  C:\Windows\System\DsTmsHQ.exe
  2⤵
  PID:9688
- C:\Windows\System\FqnRSlu.exe
  C:\Windows\System\FqnRSlu.exe
  2⤵
  PID:9716
- C:\Windows\System\HqHpgzR.exe
  C:\Windows\System\HqHpgzR.exe
  2⤵
  PID:9744
- C:\Windows\System\yciEote.exe
  C:\Windows\System\yciEote.exe
  2⤵
  PID:9772
- C:\Windows\System\PkKmcVF.exe
  C:\Windows\System\PkKmcVF.exe
  2⤵
  PID:9800
- C:\Windows\System\VviEOxs.exe
  C:\Windows\System\VviEOxs.exe
  2⤵
  PID:9828
- C:\Windows\System\igtwQKw.exe
  C:\Windows\System\igtwQKw.exe
  2⤵
  PID:9856
- C:\Windows\System\KsbUToR.exe
  C:\Windows\System\KsbUToR.exe
  2⤵
  PID:9884
- C:\Windows\System\lvreAuL.exe
  C:\Windows\System\lvreAuL.exe
  2⤵
  PID:9912
- C:\Windows\System\qeKzCah.exe
  C:\Windows\System\qeKzCah.exe
  2⤵
  PID:9940
- C:\Windows\System\keedZOk.exe
  C:\Windows\System\keedZOk.exe
  2⤵
  PID:9968
- C:\Windows\System\WmCOblQ.exe
  C:\Windows\System\WmCOblQ.exe
  2⤵
  PID:9996
- C:\Windows\System\BwyrUZg.exe
  C:\Windows\System\BwyrUZg.exe
  2⤵
  PID:10024
- C:\Windows\System\cYGgsZh.exe
  C:\Windows\System\cYGgsZh.exe
  2⤵
  PID:10052
- C:\Windows\System\tAEEhWc.exe
  C:\Windows\System\tAEEhWc.exe
  2⤵
  PID:10080
- C:\Windows\System\bMbUqaO.exe
  C:\Windows\System\bMbUqaO.exe
  2⤵
  PID:10104
- C:\Windows\System\hexiczg.exe
  C:\Windows\System\hexiczg.exe
  2⤵
  PID:10136
- C:\Windows\System\MqdutTW.exe
  C:\Windows\System\MqdutTW.exe
  2⤵
  PID:10164
- C:\Windows\System\HZANLzH.exe
  C:\Windows\System\HZANLzH.exe
  2⤵
  PID:10192
- C:\Windows\System\iercUpD.exe
  C:\Windows\System\iercUpD.exe
  2⤵
  PID:10220
- C:\Windows\System\YvhvFVv.exe
  C:\Windows\System\YvhvFVv.exe
  2⤵
  PID:9232
- C:\Windows\System\vgjRqQG.exe
  C:\Windows\System\vgjRqQG.exe
  2⤵
  PID:9304
- C:\Windows\System\pjDUNlP.exe
  C:\Windows\System\pjDUNlP.exe
  2⤵
  PID:9372
- C:\Windows\System\BQVlDyu.exe
  C:\Windows\System\BQVlDyu.exe
  2⤵
  PID:9432
- C:\Windows\System\ZrMroPf.exe
  C:\Windows\System\ZrMroPf.exe
  2⤵
  PID:9504
- C:\Windows\System\qSyxGmf.exe
  C:\Windows\System\qSyxGmf.exe
  2⤵
  PID:9568
- C:\Windows\System\SdHEaUY.exe
  C:\Windows\System\SdHEaUY.exe
  2⤵
  PID:9628
- C:\Windows\System\ytRMDRj.exe
  C:\Windows\System\ytRMDRj.exe
  2⤵
  PID:9700
- C:\Windows\System\mDmUaQs.exe
  C:\Windows\System\mDmUaQs.exe
  2⤵
  PID:9764
- C:\Windows\System\kLTNTMI.exe
  C:\Windows\System\kLTNTMI.exe
  2⤵
  PID:9824
- C:\Windows\System\smTGwZL.exe
  C:\Windows\System\smTGwZL.exe
  2⤵
  PID:9896
- C:\Windows\System\beMtuvZ.exe
  C:\Windows\System\beMtuvZ.exe
  2⤵
  PID:9980
- C:\Windows\System\ZkrltzW.exe
  C:\Windows\System\ZkrltzW.exe
  2⤵
  PID:10044
- C:\Windows\System\vCrvsjJ.exe
  C:\Windows\System\vCrvsjJ.exe
  2⤵
  PID:10100
- C:\Windows\System\beuTOZN.exe
  C:\Windows\System\beuTOZN.exe
  2⤵
  PID:10216
- C:\Windows\System\yqgopxK.exe
  C:\Windows\System\yqgopxK.exe
  2⤵
  PID:8792
- C:\Windows\System\sWaIoHQ.exe
  C:\Windows\System\sWaIoHQ.exe
  2⤵
  PID:9532
- C:\Windows\System\jjYYsjZ.exe
  C:\Windows\System\jjYYsjZ.exe
  2⤵
  PID:9684
- C:\Windows\System\GtiCThW.exe
  C:\Windows\System\GtiCThW.exe
  2⤵
  PID:9876
- C:\Windows\System\BTMzruy.exe
  C:\Windows\System\BTMzruy.exe
  2⤵
  PID:10068
- C:\Windows\System\JUkjziN.exe
  C:\Windows\System\JUkjziN.exe
  2⤵
  PID:9220
- C:\Windows\System\REUnmcJ.exe
  C:\Windows\System\REUnmcJ.exe
  2⤵
  PID:9656
- C:\Windows\System\YbCSCKn.exe
  C:\Windows\System\YbCSCKn.exe
  2⤵
  PID:10096
- C:\Windows\System\TBxTICW.exe
  C:\Windows\System\TBxTICW.exe
  2⤵
  PID:10260
- C:\Windows\System\plCldol.exe
  C:\Windows\System\plCldol.exe
  2⤵
  PID:10296
- C:\Windows\System\jgjUxdu.exe
  C:\Windows\System\jgjUxdu.exe
  2⤵
  PID:10332
- C:\Windows\System\EktYdyd.exe
  C:\Windows\System\EktYdyd.exe
  2⤵
  PID:10368
- C:\Windows\System\GKHDgsy.exe
  C:\Windows\System\GKHDgsy.exe
  2⤵
  PID:10396
- C:\Windows\System\znQRUEN.exe
  C:\Windows\System\znQRUEN.exe
  2⤵
  PID:10432
- C:\Windows\System\OzMuKvM.exe
  C:\Windows\System\OzMuKvM.exe
  2⤵
  PID:10464
- C:\Windows\System\tRDennC.exe
  C:\Windows\System\tRDennC.exe
  2⤵
  PID:10496
- C:\Windows\System\LXNnMLU.exe
  C:\Windows\System\LXNnMLU.exe
  2⤵
  PID:10520
- C:\Windows\System\WwfWCjQ.exe
  C:\Windows\System\WwfWCjQ.exe
  2⤵
  PID:10536
- C:\Windows\System\AFOXXvI.exe
  C:\Windows\System\AFOXXvI.exe
  2⤵
  PID:10564
- C:\Windows\System\ZpvihuY.exe
  C:\Windows\System\ZpvihuY.exe
  2⤵
  PID:10596
- C:\Windows\System\hNJovUi.exe
  C:\Windows\System\hNJovUi.exe
  2⤵
  PID:10628
- C:\Windows\System\CDsXqjR.exe
  C:\Windows\System\CDsXqjR.exe
  2⤵
  PID:10672
- C:\Windows\System\xKzUAcD.exe
  C:\Windows\System\xKzUAcD.exe
  2⤵
  PID:10704
- C:\Windows\System\cspFDnm.exe
  C:\Windows\System\cspFDnm.exe
  2⤵
  PID:10740
- C:\Windows\System\XxKaWgk.exe
  C:\Windows\System\XxKaWgk.exe
  2⤵
  PID:10772
- C:\Windows\System\hVzQlTi.exe
  C:\Windows\System\hVzQlTi.exe
  2⤵
  PID:10788
- C:\Windows\System\QbVmUks.exe
  C:\Windows\System\QbVmUks.exe
  2⤵
  PID:10804
- C:\Windows\System\AiUaEzl.exe
  C:\Windows\System\AiUaEzl.exe
  2⤵
  PID:10820
- C:\Windows\System\hQHrZGH.exe
  C:\Windows\System\hQHrZGH.exe
  2⤵
  PID:10852
- C:\Windows\System\wCSHTrK.exe
  C:\Windows\System\wCSHTrK.exe
  2⤵
  PID:10876
- C:\Windows\System\twpEkFt.exe
  C:\Windows\System\twpEkFt.exe
  2⤵
  PID:10928
- C:\Windows\System\ulnhapL.exe
  C:\Windows\System\ulnhapL.exe
  2⤵
  PID:10968
- C:\Windows\System\GQzoadZ.exe
  C:\Windows\System\GQzoadZ.exe
  2⤵
  PID:11004
- C:\Windows\System\JLMGacc.exe
  C:\Windows\System\JLMGacc.exe
  2⤵
  PID:11032
- C:\Windows\System\LyLWqGn.exe
  C:\Windows\System\LyLWqGn.exe
  2⤵
  PID:11060
- C:\Windows\System\UfExwSt.exe
  C:\Windows\System\UfExwSt.exe
  2⤵
  PID:11088
- C:\Windows\System\gKvudUn.exe
  C:\Windows\System\gKvudUn.exe
  2⤵
  PID:11116
- C:\Windows\System\IghDgbs.exe
  C:\Windows\System\IghDgbs.exe
  2⤵
  PID:11144
- C:\Windows\System\gyHflKk.exe
  C:\Windows\System\gyHflKk.exe
  2⤵
  PID:11172
- C:\Windows\System\LPCnmIi.exe
  C:\Windows\System\LPCnmIi.exe
  2⤵
  PID:11200
- C:\Windows\System\cnhvpcW.exe
  C:\Windows\System\cnhvpcW.exe
  2⤵
  PID:11228
- C:\Windows\System\JYNkDRY.exe
  C:\Windows\System\JYNkDRY.exe
  2⤵
  PID:11256
- C:\Windows\System\wPPCMkw.exe
  C:\Windows\System\wPPCMkw.exe
  2⤵
  PID:10284
- C:\Windows\System\BIxnsIC.exe
  C:\Windows\System\BIxnsIC.exe
  2⤵
  PID:10360
- C:\Windows\System\btjooKB.exe
  C:\Windows\System\btjooKB.exe
  2⤵
  PID:10408
- C:\Windows\System\wbAtOoK.exe
  C:\Windows\System\wbAtOoK.exe
  2⤵
  PID:10492
- C:\Windows\System\vUoqXya.exe
  C:\Windows\System\vUoqXya.exe
  2⤵
  PID:10556
- C:\Windows\System\tHpsdfS.exe
  C:\Windows\System\tHpsdfS.exe
  2⤵
  PID:10640
- C:\Windows\System\zjVWmRJ.exe
  C:\Windows\System\zjVWmRJ.exe
  2⤵
  PID:10668
- C:\Windows\System\vaoQpet.exe
  C:\Windows\System\vaoQpet.exe
  2⤵
  PID:10764
- C:\Windows\System\XJrJZJl.exe
  C:\Windows\System\XJrJZJl.exe
  2⤵
  PID:10840
- C:\Windows\System\yphTvnT.exe
  C:\Windows\System\yphTvnT.exe
  2⤵
  PID:10900
- C:\Windows\System\BAktPDD.exe
  C:\Windows\System\BAktPDD.exe
  2⤵
  PID:10952
- C:\Windows\System\bUFRHaM.exe
  C:\Windows\System\bUFRHaM.exe
  2⤵
  PID:11052
- C:\Windows\System\rSDFIga.exe
  C:\Windows\System\rSDFIga.exe
  2⤵
  PID:11112
- C:\Windows\System\kEJHZxW.exe
  C:\Windows\System\kEJHZxW.exe
  2⤵
  PID:11220
- C:\Windows\System\elLAvdl.exe
  C:\Windows\System\elLAvdl.exe
  2⤵
  PID:11252
- C:\Windows\System\wxETrgN.exe
  C:\Windows\System\wxETrgN.exe
  2⤵
  PID:10320
- C:\Windows\System\wWeYYKC.exe
  C:\Windows\System\wWeYYKC.exe
  2⤵
  PID:10508
- C:\Windows\System\QkaUEcd.exe
  C:\Windows\System\QkaUEcd.exe
  2⤵
  PID:10656
- C:\Windows\System\miEkfAg.exe
  C:\Windows\System\miEkfAg.exe
  2⤵
  PID:10800
- C:\Windows\System\QSXSfkJ.exe
  C:\Windows\System\QSXSfkJ.exe
  2⤵
  PID:10940
- C:\Windows\System\cwlbsfR.exe
  C:\Windows\System\cwlbsfR.exe
  2⤵
  PID:3460
- C:\Windows\System\yctnFHv.exe
  C:\Windows\System\yctnFHv.exe
  2⤵
  PID:11164
- C:\Windows\System\GTmfDIA.exe
  C:\Windows\System\GTmfDIA.exe
  2⤵
  PID:11248
- C:\Windows\System\aoejTOD.exe
  C:\Windows\System\aoejTOD.exe
  2⤵
  PID:10484
- C:\Windows\System\jQWgjme.exe
  C:\Windows\System\jQWgjme.exe
  2⤵
  PID:10732
- C:\Windows\System\GoGkJSw.exe
  C:\Windows\System\GoGkJSw.exe
  2⤵
  PID:11100
- C:\Windows\System\JCgWMom.exe
  C:\Windows\System\JCgWMom.exe
  2⤵
  PID:10344
- C:\Windows\System\AwAbXVZ.exe
  C:\Windows\System\AwAbXVZ.exe
  2⤵
  PID:2300
- C:\Windows\System\fGQtZPb.exe
  C:\Windows\System\fGQtZPb.exe
  2⤵
  PID:4936
- C:\Windows\System\qNydWiO.exe
  C:\Windows\System\qNydWiO.exe
  2⤵
  PID:11284
- C:\Windows\System\KTjkgmN.exe
  C:\Windows\System\KTjkgmN.exe
  2⤵
  PID:11312
- C:\Windows\System\rWxMSmP.exe
  C:\Windows\System\rWxMSmP.exe
  2⤵
  PID:11340
- C:\Windows\System\mvyCpDB.exe
  C:\Windows\System\mvyCpDB.exe
  2⤵
  PID:11372
- C:\Windows\System\TXcWFUH.exe
  C:\Windows\System\TXcWFUH.exe
  2⤵
  PID:11400
- C:\Windows\System\OeefOII.exe
  C:\Windows\System\OeefOII.exe
  2⤵
  PID:11416
- C:\Windows\System\QgLiEuf.exe
  C:\Windows\System\QgLiEuf.exe
  2⤵
  PID:11456
- C:\Windows\System\PyjHeMN.exe
  C:\Windows\System\PyjHeMN.exe
  2⤵
  PID:11484
- C:\Windows\System\baqYVuJ.exe
  C:\Windows\System\baqYVuJ.exe
  2⤵
  PID:11512
- C:\Windows\System\znBUHqY.exe
  C:\Windows\System\znBUHqY.exe
  2⤵
  PID:11540
- C:\Windows\System\hOtHmxm.exe
  C:\Windows\System\hOtHmxm.exe
  2⤵
  PID:11568
- C:\Windows\System\OiDAJWZ.exe
  C:\Windows\System\OiDAJWZ.exe
  2⤵
  PID:11596
- C:\Windows\System\rndfRRt.exe
  C:\Windows\System\rndfRRt.exe
  2⤵
  PID:11624
- C:\Windows\System\UyQRmWB.exe
  C:\Windows\System\UyQRmWB.exe
  2⤵
  PID:11652
- C:\Windows\System\TaAYRhh.exe
  C:\Windows\System\TaAYRhh.exe
  2⤵
  PID:11680
- C:\Windows\System\yNCuimJ.exe
  C:\Windows\System\yNCuimJ.exe
  2⤵
  PID:11708
- C:\Windows\System\Inkuuql.exe
  C:\Windows\System\Inkuuql.exe
  2⤵
  PID:11724
- C:\Windows\System\gtQyQdC.exe
  C:\Windows\System\gtQyQdC.exe
  2⤵
  PID:11760
- C:\Windows\System\yTBoteM.exe
  C:\Windows\System\yTBoteM.exe
  2⤵
  PID:11792
- C:\Windows\System\FSvxGdu.exe
  C:\Windows\System\FSvxGdu.exe
  2⤵
  PID:11820
- C:\Windows\System\QqpvhBx.exe
  C:\Windows\System\QqpvhBx.exe
  2⤵
  PID:11848
- C:\Windows\System\smjSLgn.exe
  C:\Windows\System\smjSLgn.exe
  2⤵
  PID:11876
- C:\Windows\System\BUWAIdi.exe
  C:\Windows\System\BUWAIdi.exe
  2⤵
  PID:11904
- C:\Windows\System\rSDkiXG.exe
  C:\Windows\System\rSDkiXG.exe
  2⤵
  PID:11932
- C:\Windows\System\WDFQuYZ.exe
  C:\Windows\System\WDFQuYZ.exe
  2⤵
  PID:11960
- C:\Windows\System\ZIGOMyR.exe
  C:\Windows\System\ZIGOMyR.exe
  2⤵
  PID:11988
- C:\Windows\System\HQexOSL.exe
  C:\Windows\System\HQexOSL.exe
  2⤵
  PID:12016
- C:\Windows\System\hHVkwjB.exe
  C:\Windows\System\hHVkwjB.exe
  2⤵
  PID:12048
- C:\Windows\System\GiLPxdf.exe
  C:\Windows\System\GiLPxdf.exe
  2⤵
  PID:12076
- C:\Windows\System\TjEThQI.exe
  C:\Windows\System\TjEThQI.exe
  2⤵
  PID:12104
- C:\Windows\System\CeifMVC.exe
  C:\Windows\System\CeifMVC.exe
  2⤵
  PID:12132
- C:\Windows\System\qnZstMI.exe
  C:\Windows\System\qnZstMI.exe
  2⤵
  PID:12160
- C:\Windows\System\ciSjuJv.exe
  C:\Windows\System\ciSjuJv.exe
  2⤵
  PID:12188
- C:\Windows\System\BkskYpm.exe
  C:\Windows\System\BkskYpm.exe
  2⤵
  PID:12216
- C:\Windows\System\StkogaY.exe
  C:\Windows\System\StkogaY.exe
  2⤵
  PID:12244
- C:\Windows\System\XotvSyH.exe
  C:\Windows\System\XotvSyH.exe
  2⤵
  PID:12272
- C:\Windows\System\zYesYNH.exe
  C:\Windows\System\zYesYNH.exe
  2⤵
  PID:11296
- C:\Windows\System\fkhogan.exe
  C:\Windows\System\fkhogan.exe
  2⤵
  PID:11364
- C:\Windows\System\ecWeJHh.exe
  C:\Windows\System\ecWeJHh.exe
  2⤵
  PID:11428
- C:\Windows\System\ZbWTxMh.exe
  C:\Windows\System\ZbWTxMh.exe
  2⤵
  PID:11496
- C:\Windows\System\fiLypmQ.exe
  C:\Windows\System\fiLypmQ.exe
  2⤵
  PID:11556
- C:\Windows\System\uljeuQI.exe
  C:\Windows\System\uljeuQI.exe
  2⤵
  PID:11620
- C:\Windows\System\yoGgnnL.exe
  C:\Windows\System\yoGgnnL.exe
  2⤵
  PID:11692
- C:\Windows\System\zIxAuWr.exe
  C:\Windows\System\zIxAuWr.exe
  2⤵
  PID:11756
- C:\Windows\System\dbHwBnF.exe
  C:\Windows\System\dbHwBnF.exe
  2⤵
  PID:11812
- C:\Windows\System\iGpUJLB.exe
  C:\Windows\System\iGpUJLB.exe
  2⤵
  PID:11888
- C:\Windows\System\rSbErXX.exe
  C:\Windows\System\rSbErXX.exe
  2⤵
  PID:11944
- C:\Windows\System\vzUHnhj.exe
  C:\Windows\System\vzUHnhj.exe
  2⤵
  PID:12044
- C:\Windows\System\OYChfmL.exe
  C:\Windows\System\OYChfmL.exe
  2⤵
  PID:12088
- C:\Windows\System\hqYIkgw.exe
  C:\Windows\System\hqYIkgw.exe
  2⤵
  PID:12152
- C:\Windows\System\PYrJnxY.exe
  C:\Windows\System\PYrJnxY.exe
  2⤵
  PID:12212
- C:\Windows\System\tQGGELY.exe
  C:\Windows\System\tQGGELY.exe
  2⤵
  PID:12264
- C:\Windows\System\kqxDVNX.exe
  C:\Windows\System\kqxDVNX.exe
  2⤵
  PID:11356
- C:\Windows\System\ifqrDRX.exe
  C:\Windows\System\ifqrDRX.exe
  2⤵
  PID:11528
- C:\Windows\System\GkqtaSy.exe
  C:\Windows\System\GkqtaSy.exe
  2⤵
  PID:11716
- C:\Windows\System\jeqEpKW.exe
  C:\Windows\System\jeqEpKW.exe
  2⤵
  PID:11844
- C:\Windows\System\ihdRDyg.exe
  C:\Windows\System\ihdRDyg.exe
  2⤵
  PID:12004
- C:\Windows\System\AJHLtBo.exe
  C:\Windows\System\AJHLtBo.exe
  2⤵
  PID:12128
- C:\Windows\System\kEoSlkZ.exe
  C:\Windows\System\kEoSlkZ.exe
  2⤵
  PID:11280
- C:\Windows\System\LCFvtxm.exe
  C:\Windows\System\LCFvtxm.exe
  2⤵
  PID:11608
- C:\Windows\System\kYhWPqL.exe
  C:\Windows\System\kYhWPqL.exe
  2⤵
  PID:12068
- C:\Windows\System\iUysXnV.exe
  C:\Windows\System\iUysXnV.exe
  2⤵
  PID:11648
- C:\Windows\System\GbPFDef.exe
  C:\Windows\System\GbPFDef.exe
  2⤵
  PID:12284
- C:\Windows\System\EwedBwb.exe
  C:\Windows\System\EwedBwb.exe
  2⤵
  PID:12304
- C:\Windows\System\pZggxxF.exe
  C:\Windows\System\pZggxxF.exe
  2⤵
  PID:12332
- C:\Windows\System\VwaiRcB.exe
  C:\Windows\System\VwaiRcB.exe
  2⤵
  PID:12360
- C:\Windows\System\SJSNnNh.exe
  C:\Windows\System\SJSNnNh.exe
  2⤵
  PID:12388
- C:\Windows\System\CrnrdmE.exe
  C:\Windows\System\CrnrdmE.exe
  2⤵
  PID:12440
- C:\Windows\System\VpbZFDW.exe
  C:\Windows\System\VpbZFDW.exe
  2⤵
  PID:12460
- C:\Windows\System\nEeywoy.exe
  C:\Windows\System\nEeywoy.exe
  2⤵
  PID:12488
- C:\Windows\System\LlhDpbk.exe
  C:\Windows\System\LlhDpbk.exe
  2⤵
  PID:12516
- C:\Windows\System\eARQvis.exe
  C:\Windows\System\eARQvis.exe
  2⤵
  PID:12544
- C:\Windows\System\alTiXOv.exe
  C:\Windows\System\alTiXOv.exe
  2⤵
  PID:12572
- C:\Windows\System\CaQjvvS.exe
  C:\Windows\System\CaQjvvS.exe
  2⤵
  PID:12600
- C:\Windows\System\RDNCqCc.exe
  C:\Windows\System\RDNCqCc.exe
  2⤵
  PID:12628
- C:\Windows\System\RihFBed.exe
  C:\Windows\System\RihFBed.exe
  2⤵
  PID:12656
- C:\Windows\System\vKLcOSs.exe
  C:\Windows\System\vKLcOSs.exe
  2⤵
  PID:12684
- C:\Windows\System\vhmBAFx.exe
  C:\Windows\System\vhmBAFx.exe
  2⤵
  PID:12712
- C:\Windows\System\PanWtAT.exe
  C:\Windows\System\PanWtAT.exe
  2⤵
  PID:12728
- C:\Windows\System\SfxStNZ.exe
  C:\Windows\System\SfxStNZ.exe
  2⤵
  PID:12756
- C:\Windows\System\lFtGnWU.exe
  C:\Windows\System\lFtGnWU.exe
  2⤵
  PID:12784
- C:\Windows\System\ciRPThW.exe
  C:\Windows\System\ciRPThW.exe
  2⤵
  PID:12804
- C:\Windows\System\noNUMgy.exe
  C:\Windows\System\noNUMgy.exe
  2⤵
  PID:12840
- C:\Windows\System\CnPfrbs.exe
  C:\Windows\System\CnPfrbs.exe
  2⤵
  PID:12868
- C:\Windows\System\XymgWhH.exe
  C:\Windows\System\XymgWhH.exe
  2⤵
  PID:12892
- C:\Windows\System\sPznINx.exe
  C:\Windows\System\sPznINx.exe
  2⤵
  PID:12920
- C:\Windows\System\oaQPxFU.exe
  C:\Windows\System\oaQPxFU.exe
  2⤵
  PID:12948
- C:\Windows\System\sjoZpLo.exe
  C:\Windows\System\sjoZpLo.exe
  2⤵
  PID:12968
- C:\Windows\System\quwqtqG.exe
  C:\Windows\System\quwqtqG.exe
  2⤵
  PID:12984
- C:\Windows\System\ezisrzY.exe
  C:\Windows\System\ezisrzY.exe
  2⤵
  PID:13008
- C:\Windows\System\ybDzZUO.exe
  C:\Windows\System\ybDzZUO.exe
  2⤵
  PID:13044
- C:\Windows\System\wvZUpRs.exe
  C:\Windows\System\wvZUpRs.exe
  2⤵
  PID:13080
- C:\Windows\System\SOixKpX.exe
  C:\Windows\System\SOixKpX.exe
  2⤵
  PID:13100
- C:\Windows\System\qVjnLdh.exe
  C:\Windows\System\qVjnLdh.exe
  2⤵
  PID:13132
- C:\Windows\System\nvjPtVy.exe
  C:\Windows\System\nvjPtVy.exe
  2⤵
  PID:13164
- C:\Windows\System\qDxelwj.exe
  C:\Windows\System\qDxelwj.exe
  2⤵
  PID:13192
- C:\Windows\System\hbhrcfw.exe
  C:\Windows\System\hbhrcfw.exe
  2⤵
  PID:13220
- C:\Windows\System\dKeyrEP.exe
  C:\Windows\System\dKeyrEP.exe
  2⤵
  PID:13240
- C:\Windows\System\ftyrXac.exe
  C:\Windows\System\ftyrXac.exe
  2⤵
  PID:13268
- C:\Windows\System\wgZMald.exe
  C:\Windows\System\wgZMald.exe
  2⤵
  PID:13300
- C:\Windows\System\UcvFMXZ.exe
  C:\Windows\System\UcvFMXZ.exe
  2⤵
  PID:12408
- C:\Windows\System\RBYGPrN.exe
  C:\Windows\System\RBYGPrN.exe
  2⤵
  PID:12480
- C:\Windows\System\DdswwtC.exe
  C:\Windows\System\DdswwtC.exe
  2⤵
  PID:4520
- C:\Windows\System\CecmUbU.exe
  C:\Windows\System\CecmUbU.exe
  2⤵
  PID:12556
- C:\Windows\System\DgWnfGG.exe
  C:\Windows\System\DgWnfGG.exe
  2⤵
  PID:12624
- C:\Windows\System\sfAjWoU.exe
  C:\Windows\System\sfAjWoU.exe
  2⤵
  PID:12668
- C:\Windows\System\ODNWPlY.exe
  C:\Windows\System\ODNWPlY.exe
  2⤵
  PID:12720
- C:\Windows\System\kVkmSQS.exe
  C:\Windows\System\kVkmSQS.exe
  2⤵
  PID:12816
- C:\Windows\System\nuJzwhl.exe
  C:\Windows\System\nuJzwhl.exe
  2⤵
  PID:12884
- C:\Windows\System\buHxHDB.exe
  C:\Windows\System\buHxHDB.exe
  2⤵
  PID:12944
- C:\Windows\System\znURrOE.exe
  C:\Windows\System\znURrOE.exe
  2⤵
  PID:13068
- C:\Windows\System\qXlxWDu.exe
  C:\Windows\System\qXlxWDu.exe
  2⤵
  PID:13036
- C:\Windows\System\JKgbwIc.exe
  C:\Windows\System\JKgbwIc.exe
  2⤵
  PID:13096
- C:\Windows\System\uydOBdZ.exe
  C:\Windows\System\uydOBdZ.exe
  2⤵
  PID:13112
- C:\Windows\System\iSYCFRI.exe
  C:\Windows\System\iSYCFRI.exe
  2⤵
  PID:13276
- C:\Windows\System\XwZESRN.exe
  C:\Windows\System\XwZESRN.exe
  2⤵
  PID:12312
- C:\Windows\System\pEfXngI.exe
  C:\Windows\System\pEfXngI.exe
  2⤵
  PID:12448
- C:\Windows\System\mfuYuyq.exe
  C:\Windows\System\mfuYuyq.exe
  2⤵
  PID:12592
- C:\Windows\System\rnhwCvt.exe
  C:\Windows\System\rnhwCvt.exe
  2⤵
  PID:12744
- C:\Windows\System\xTzJaER.exe
  C:\Windows\System\xTzJaER.exe
  2⤵
  PID:12904
- C:\Windows\System\iXHLvVR.exe
  C:\Windows\System\iXHLvVR.exe
  2⤵
  PID:13004
- C:\Windows\System\tvRwkUF.exe
  C:\Windows\System\tvRwkUF.exe
  2⤵
  PID:13064
- C:\Windows\System\fCPkdKw.exe
  C:\Windows\System\fCPkdKw.exe
  2⤵
  PID:12400
- C:\Windows\System\BrehpBa.exe
  C:\Windows\System\BrehpBa.exe
  2⤵
  PID:12700
- C:\Windows\System\uEgRnDk.exe
  C:\Windows\System\uEgRnDk.exe
  2⤵
  PID:12996
- C:\Windows\System\ozySpZQ.exe
  C:\Windows\System\ozySpZQ.exe
  2⤵
  PID:12292
- C:\Windows\System\WGWExWZ.exe
  C:\Windows\System\WGWExWZ.exe
  2⤵
  PID:12856
- C:\Windows\System\DPVJhXM.exe
  C:\Windows\System\DPVJhXM.exe
  2⤵
  PID:13316
- C:\Windows\System\YLzFulM.exe
  C:\Windows\System\YLzFulM.exe
  2⤵
  PID:13352
- C:\Windows\System\uKzxOUn.exe
  C:\Windows\System\uKzxOUn.exe
  2⤵
  PID:13380
- C:\Windows\System\Necupjm.exe
  C:\Windows\System\Necupjm.exe
  2⤵
  PID:13412
- C:\Windows\System\nqmrrMj.exe
  C:\Windows\System\nqmrrMj.exe
  2⤵
  PID:13440
- C:\Windows\System\RPGRlhX.exe
  C:\Windows\System\RPGRlhX.exe
  2⤵
  PID:13464
- C:\Windows\System\kUZssFv.exe
  C:\Windows\System\kUZssFv.exe
  2⤵
  PID:13496
- C:\Windows\System\hSqKTVp.exe
  C:\Windows\System\hSqKTVp.exe
  2⤵
  PID:13520
- C:\Windows\System\kXrMQfB.exe
  C:\Windows\System\kXrMQfB.exe
  2⤵
  PID:13556
- C:\Windows\System\hCNCmCN.exe
  C:\Windows\System\hCNCmCN.exe
  2⤵
  PID:13584
- C:\Windows\System\cuvWDvK.exe
  C:\Windows\System\cuvWDvK.exe
  2⤵
  PID:13608
- C:\Windows\System\FJPVsMx.exe
  C:\Windows\System\FJPVsMx.exe
  2⤵
  PID:13640
- C:\Windows\System\xJmZkFZ.exe
  C:\Windows\System\xJmZkFZ.exe
  2⤵
  PID:13668
- C:\Windows\System\ioFPYFs.exe
  C:\Windows\System\ioFPYFs.exe
  2⤵
  PID:13688
- C:\Windows\System\fqxUhLb.exe
  C:\Windows\System\fqxUhLb.exe
  2⤵
  PID:13716
- C:\Windows\System\SFWNZCy.exe
  C:\Windows\System\SFWNZCy.exe
  2⤵
  PID:13736
- C:\Windows\System\PSILpzm.exe
  C:\Windows\System\PSILpzm.exe
  2⤵
  PID:13764
- C:\Windows\System\ixstnZX.exe
  C:\Windows\System\ixstnZX.exe
  2⤵
  PID:13788
- C:\Windows\System\PGdtTzE.exe
  C:\Windows\System\PGdtTzE.exe
  2⤵
  PID:13824
- C:\Windows\System\smXTtzL.exe
  C:\Windows\System\smXTtzL.exe
  2⤵
  PID:13852
- C:\Windows\System\wqEEGBt.exe
  C:\Windows\System\wqEEGBt.exe
  2⤵
  PID:13876
- C:\Windows\System\wTKDMzq.exe
  C:\Windows\System\wTKDMzq.exe
  2⤵
  PID:13900
- C:\Windows\System\NyyMoOw.exe
  C:\Windows\System\NyyMoOw.exe
  2⤵
  PID:13936
- C:\Windows\System\iFLnvjr.exe
  C:\Windows\System\iFLnvjr.exe
  2⤵
  PID:13964
- C:\Windows\System\vVNkEJU.exe
  C:\Windows\System\vVNkEJU.exe
  2⤵
  PID:14004
- C:\Windows\System\GMEYWxz.exe
  C:\Windows\System\GMEYWxz.exe
  2⤵
  PID:14032
- C:\Windows\System\PfEAydQ.exe
  C:\Windows\System\PfEAydQ.exe
  2⤵
  PID:14060
- C:\Windows\System\BUxsrTA.exe
  C:\Windows\System\BUxsrTA.exe
  2⤵
  PID:14076
- C:\Windows\System\MhjQJWa.exe
  C:\Windows\System\MhjQJWa.exe
  2⤵
  PID:14116
- C:\Windows\System\cFxdDwR.exe
  C:\Windows\System\cFxdDwR.exe
  2⤵
  PID:14140
- C:\Windows\System\iiXGFZq.exe
  C:\Windows\System\iiXGFZq.exe
  2⤵
  PID:14160
- C:\Windows\System\KlUcTAA.exe
  C:\Windows\System\KlUcTAA.exe
  2⤵
  PID:14180
- C:\Windows\System\MAOeSCm.exe
  C:\Windows\System\MAOeSCm.exe
  2⤵
  PID:14208
- C:\Windows\System\GKhiAct.exe
  C:\Windows\System\GKhiAct.exe
  2⤵
  PID:14236
- C:\Windows\System\bjPGDNK.exe
  C:\Windows\System\bjPGDNK.exe
  2⤵
  PID:14264
- C:\Windows\System\JAtGBPX.exe
  C:\Windows\System\JAtGBPX.exe
  2⤵
  PID:14296
- C:\Windows\System\tJnAxMc.exe
  C:\Windows\System\tJnAxMc.exe
  2⤵
  PID:14312
- C:\Windows\System\EdHcxUN.exe
  C:\Windows\System\EdHcxUN.exe
  2⤵
  PID:14332
- C:\Windows\System\OMJoQzi.exe
  C:\Windows\System\OMJoQzi.exe
  2⤵
  PID:13340
- C:\Windows\System\iPxYcMV.exe
  C:\Windows\System\iPxYcMV.exe
  2⤵
  PID:13424
- C:\Windows\System\JVCxvxa.exe
  C:\Windows\System\JVCxvxa.exe
  2⤵
  PID:13504
- C:\Windows\System\KBjvkCU.exe
  C:\Windows\System\KBjvkCU.exe
  2⤵
  PID:13604
- C:\Windows\System\dxNJqPD.exe
  C:\Windows\System\dxNJqPD.exe
  2⤵
  PID:13660
- C:\Windows\System\zlRljeR.exe
  C:\Windows\System\zlRljeR.exe
  2⤵
  PID:13732
- C:\Windows\System\KQpQEds.exe
  C:\Windows\System\KQpQEds.exe
  2⤵
  PID:3400
- C:\Windows\System\vFHaYJC.exe
  C:\Windows\System\vFHaYJC.exe
  2⤵
  PID:13784
- C:\Windows\System\FILybsO.exe
  C:\Windows\System\FILybsO.exe
  2⤵
  PID:13836
- C:\Windows\System\hRciAPC.exe
  C:\Windows\System\hRciAPC.exe
  2⤵
  PID:13888
- C:\Windows\System\nIJkqsS.exe
  C:\Windows\System\nIJkqsS.exe
  2⤵
  PID:13924
- C:\Windows\System\xbbsTio.exe
  C:\Windows\System\xbbsTio.exe
  2⤵
  PID:13956
- C:\Windows\System\KTiNTfj.exe
  C:\Windows\System\KTiNTfj.exe
  2⤵
  PID:14016
- C:\Windows\System\KpCyKWL.exe
  C:\Windows\System\KpCyKWL.exe
  2⤵
  PID:14096
- C:\Windows\System\ZeVgDDW.exe
  C:\Windows\System\ZeVgDDW.exe
  2⤵
  PID:14228
- C:\Windows\System\mrBcJpS.exe
  C:\Windows\System\mrBcJpS.exe
  2⤵
  PID:14252
- C:\Windows\System\nQrEDIg.exe
  C:\Windows\System\nQrEDIg.exe
  2⤵
  PID:14292
- C:\Windows\System\qVvwKfB.exe
  C:\Windows\System\qVvwKfB.exe
  2⤵
  PID:13392
- C:\Windows\System\OZkAUPq.exe
  C:\Windows\System\OZkAUPq.exe
  2⤵
  PID:13628
- C:\Windows\System\bUXQWki.exe
  C:\Windows\System\bUXQWki.exe
  2⤵
  PID:13728
- C:\Windows\System\UdRWcFQ.exe
  C:\Windows\System\UdRWcFQ.exe
  2⤵
  PID:2056
- C:\Windows\System\PGscMZZ.exe
  C:\Windows\System\PGscMZZ.exe
  2⤵
  PID:13912
- C:\Windows\System\jxUGwAy.exe
  C:\Windows\System\jxUGwAy.exe
  2⤵
  PID:14088
- C:\Windows\System\ufCuHfS.exe
  C:\Windows\System\ufCuHfS.exe
  2⤵
  PID:1492
- C:\Windows\System\WlbiqYu.exe
  C:\Windows\System\WlbiqYu.exe
  2⤵
  PID:13324
- C:\Windows\System\IiZUrIe.exe
  C:\Windows\System\IiZUrIe.exe
  2⤵
  PID:628
- C:\Windows\System\BGzbKla.exe
  C:\Windows\System\BGzbKla.exe
  2⤵
  PID:13760
- C:\Windows\System\jbQaahS.exe
  C:\Windows\System\jbQaahS.exe
  2⤵
  PID:14216
- C:\Windows\System\RfFRQrL.exe
  C:\Windows\System\RfFRQrL.exe
  2⤵
  PID:13516
- C:\Windows\System\BhkiTqP.exe
  C:\Windows\System\BhkiTqP.exe
  2⤵
  PID:13872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BMwNlRz.exe

Filesize
2.0MB

MD5
27727f859e1bc846dd04e2b7a2f5a188

SHA1
c2723b76a243dc5cb77c192a7ae0d4b4284ff238

SHA256
d4a3ef6cfa1c2be9dd213bc87e76612072067f74b3a2534b9e53a8ecea473386

SHA512
aa1e0cbe2b73cfb92bb439f636e06c05b9d6bb135b954a2628bca741ebea988b4e87c4a132abad8a1bcaa5c64f42b5124e2dd41e1ec0548d3f0763ae74275479

Download Submit
C:\Windows\System\DTluPQZ.exe

Filesize
2.0MB

MD5
06838d95dc9866b509b7fa6c87ab139a

SHA1
7898fd6634f00ddd050b236b37896ba6f823bae6

SHA256
8e58aaa15d752f1ec7a7efe98e47c81872b17b28d2dc1ddcd0231df62644d4b5

SHA512
0c96736d7adf04288c3e456298304b701b7cbfe0a9b447576e24003527729927ed0a508a116d035de2c46bac2f6f914212696ae9f86c26df7492d75b1b7c012d

Download Submit
C:\Windows\System\DgQbSkJ.exe

Filesize
2.0MB

MD5
7e4d56eb7e68bcbd8b757fa165b8b89a

SHA1
c8ed93633021b2ff42216bbe35e80d8c7c937470

SHA256
c82bb93c0d6401fd5a28516a7219373a08410e764cabfa541620bbab6abbc5a8

SHA512
40daee7ca5c61d51430b47224f95677f1d1651c042080d3b697eb37064307ea127038c1a52cc93aabca9a887fd163e683604390d276476e09ec5bfff57c184d9

Download Submit
C:\Windows\System\FGvWbFS.exe

Filesize
2.0MB

MD5
1677bf801dc795247a7133a210d2b419

SHA1
d3d6ba4302ffc966201ed540a5103904c752cd97

SHA256
fad4fc2adbf3f9b2a528c7685fe0a31287501ce1b8389009bcc3b95f96331e24

SHA512
4926850f65420d9926f59da0363bf9e95a421a5964116d6f935e1941df5d0cba3edd11e2eb945601f414321a8434f44a9e1efc385cbe2c553ca8a15bda0ddb18

Download Submit
C:\Windows\System\FXmrmvL.exe

Filesize
2.0MB

MD5
8c50e91c872e56fc079a17fa05e82afb

SHA1
6b7fdbc6b6e95524b7de65476d889b9274e32a10

SHA256
585ac774f2637c142c777cd9b3252832e9f519fe4986e7e529209fe20127811d

SHA512
00415f850ad6a4b6131687280b21c244aaaffc83893dff119763c8404d8c5bf2be9ee5a62546d1e336c84094d21e7571779f0b28aeb4778da2603c4c0fe5e396

Download Submit
C:\Windows\System\FhFAYQz.exe

Filesize
2.0MB

MD5
37f0230d09801d4c25a4a0acaaf6e97c

SHA1
8d6ef4e096b0b04f07b824708559a5671f52063a

SHA256
82627d7014a2b5adf00790c9190d282818145536802ea948283e46d9a5b5a07e

SHA512
7f58a0a4322124bd72a42e2ce52ff3afea26ded4b5a5625a60d2baa78ebbc8cc14331d19e2acb7e6e999b35105e3a7556008a3e8c8284cad9ee076130ffd3a2a

Download Submit
C:\Windows\System\INvHirY.exe

Filesize
2.0MB

MD5
fa14d14b95da273a28a5e9bc1336a8d1

SHA1
f089081583b66d01080fe1e4baaca0fc2af128a7

SHA256
3aab7bb8b4e452bfddaa4107b3fe0e0949aee3efacc7f2c8fe55da4125d26b31

SHA512
b3ce32be3b38eb5ed9e1cbec7957ae106d9ecec648180106d65f3b0aec8ef3920472ef352623b90dd009aa7ee8b83fb5448eb92cdaff74040677f34bd993ad22

Download Submit
C:\Windows\System\IkosEYN.exe

Filesize
2.0MB

MD5
87d3b3883382e4441eccbedc34e91261

SHA1
17d731cf8d818a188359a7ac26b7b1e9a0791721

SHA256
4a840649c2527ba5f57b481122ae189ba44d2e274d22073e0fdbfeae7d661995

SHA512
073894ad19a449260fc7895cd165cd6843a69234bb954534c5215c88739895066a83679a1c9858fe41fb3368bdd139c56ead36bf2e98d5e14ee63f2f58992fb5

Download Submit
C:\Windows\System\KXwGWOE.exe

Filesize
2.0MB

MD5
6743c8e082b57c9237ac6655eaad9589

SHA1
49fe5ea28432d53a27190bcacc79479d7387d952

SHA256
fa2ddce7e96f741ccb073a7551795386b122814797bdac827cf00f534297b879

SHA512
c69db296c343c1b9b91570f0d0b542016fe9c54cdc237e3e3d96ea3c8c6a1e6e7bc710e45c39a02f1cd7de6fadc50f456ecb45385e709ac69eb6d90fd636252d

Download Submit
C:\Windows\System\MvyiKOk.exe

Filesize
2.0MB

MD5
009aab9995a864ef2ab0761a35f6b1cf

SHA1
b058160b207d3b701ebc80864f4051cf4851e2c9

SHA256
e2c2da214158e205eaaa9fcd3cb9a830de566c5a9238427b2e0527d2879dee8c

SHA512
0286022deab521d0d6a7c2f801b20bc77663112955fb7535c02289b115f669d9925b800c162a3e2205b64aa5320e866ae3ffb05aebdb60486e5a1939615650ab

Download Submit
C:\Windows\System\NgesGgL.exe

Filesize
2.0MB

MD5
83dd9a50a7e3dc2e15284adb70d3850d

SHA1
660430edac0ddb7d25852e336100fa8a90cfe41e

SHA256
5b62c7c1ddf4e1eaf2591bcbfb54f1e38606a3ff052ef1213ffaa18f4b886808

SHA512
1e9657a37731b6892af96ff1ef6f750a63178f93d1b8b50778fa87000210b6aac8c25432675f00ced3791c2dd64fe63faac92377092b258d77838e3ffa1e01e9

Download Submit
C:\Windows\System\PDLNWjZ.exe

Filesize
2.0MB

MD5
5b3d78c81d5550ef79aa929803a1085b

SHA1
18c86f2a4db103cb16a22b0afe31b461b87ba27c

SHA256
f4bd965eb10257780ec4008018bf6021f622332cc64654a3eb60d593cf48d48c

SHA512
05c2866224460a56b0bfb0802f3592ff4ccd635470271c780b14882b879d4ec2f90190b1d7ab0d09fe6e806e73529270dd83b738862c1ffacacff92ca2c4349a

Download Submit
C:\Windows\System\RpTqSoi.exe

Filesize
2.0MB

MD5
2572c84e3c48747bdb4df1702efb7fb0

SHA1
dd856f586d75285aa355041432e9af73a3ae2b09

SHA256
0cb9bfcb4b0475e9488c676a27cb3fdf1731fd27f5fa71cd0efc8b54d843df57

SHA512
2e38b6f2419e89d0172901508ce29e7c5e1af81e1b04d20e2ce5691ead20a55a96191a7dea409cd7af504e0ea4460e632e8c0f417e0883d9b713ddfaf7d10b93

Download Submit
C:\Windows\System\RrjGFHV.exe

Filesize
2.0MB

MD5
14cc737f4b50cdf2f79a06421ed8fd25

SHA1
b8c9ee899e5472d024bade79da429ba499361bb7

SHA256
2cff14212ce6069cc12c7e5b267d4b5fcf5807f14a7e5e96092cdc8d1b4fa6e5

SHA512
5e0586848355dc2b5e684b673a198467491496cd741e22602aefff84014291f55b28ee3ba1eaec9744a37c5793a6dee11e9d56df2f2ee9e3100ac1223ff80a31

Download Submit
C:\Windows\System\Unqsjrl.exe

Filesize
2.0MB

MD5
d89eb4b3486a3a20be7bd325cbfcdb01

SHA1
e37f06b29cf7dde6b42f5ccd968bc7878010a400

SHA256
c7b8e12d707439afa0a5206fcce3d159741266ce8c455a28c4787301c980bef4

SHA512
cb078d277f879ba3ecbb32076157070759e129a1128c35923a6f5b021a61318b02b6695d39394ea9c08b4f98d5f8de51f83fd42a4db2037affb20745f19ab1a5

Download Submit
C:\Windows\System\YIGcHzM.exe

Filesize
2.0MB

MD5
2dbbbbf7bf8f3907466d5033400e9170

SHA1
4bc5e61e2f307c49d08ee304ee0b27a91be80ddf

SHA256
415eacddd406b2f2be30498818ebd2e4a4adf934ddf8a1b32b800ca46c3988e1

SHA512
73eb4bb0270e3a392ded92256e2b614169570b1c1065960474741f4bd300a0dfe7ea9b90a372ad33ba6b2f88e9af5c520577867823cf4cd129984762617217dd

Download Submit
C:\Windows\System\YfHvHhb.exe

Filesize
2.0MB

MD5
656d45c11b982e64e7eb4f4d0b8d0cc6

SHA1
31c152442252a25f85e0ea9294f1366593d79408

SHA256
46bc5c3813faa9ae56c84797d912e3360e3051f2c46289e27b74166973e2c620

SHA512
8ededa149cdf203736a0cf929b4622bfe99d6706310c66675bcea5d75259ec6150f3a66882f7f654ec50e49bf7a2c3224e985eb31bc6091f5ab5a1ff16f1e248

Download Submit
C:\Windows\System\aexBxwA.exe

Filesize
2.0MB

MD5
db2d31df29bf85ca673cdaf295b7a153

SHA1
cb499d68b821f21b8853505b215ab0aeded39fa2

SHA256
415530bb62594a980a16b8b69b4b4d6e4cabc3272c244b1df758295a96d7633c

SHA512
a3f83c2656337af7a34b8aacacd17089373f1200c38ad27a5777c218d3a1cf95d948e4353ff2eddb0d0cf61197efd36febc4852a70eadb3aed87ed1dbc2b50d8

Download Submit
C:\Windows\System\bGRDRqT.exe

Filesize
2.0MB

MD5
938776c9405e84d29bf0f00f548c0baf

SHA1
aa0b5ce6357aae96f79e63f16eb30a76f2c9641b

SHA256
1afb458ed5883eed090a0ede10391733eacb7622fc80b380dbcc2cb090a85e3a

SHA512
b77154a4bf6954f406b08d4faf55496a580c483d25ca4006d3f138405d1a4679dec1f8b8c2b8258a9fc73309088b56c6a8f43bb3fa5d8f636546d84d1f9785d3

Download Submit
C:\Windows\System\ePfMPLp.exe

Filesize
2.0MB

MD5
df592620dd53b52e7ce563e8c87794d7

SHA1
9b4770baf43930978d5807beafdf4beb87fa1f86

SHA256
4c1947fcbb28d3c1828c42b735683962de81e5eea74828de76343968ac57a59c

SHA512
590e438532d23993b6d03106b40a74d40450fcc75a4ebb3eacecb1d07d785735bb1ab9d4e42cf2021217be95b405e8d7077ff0ffc3c1c1251fd9753e3ad7c2c4

Download Submit
C:\Windows\System\gIijHGm.exe

Filesize
2.0MB

MD5
b1c4aaf0d455013f64a4136181f1dbaf

SHA1
2d7047aa892ef53ac130ecd7cf6f6b4ca35fc22f

SHA256
8da4f9a9bd024992bf97b2733f839796cda2a4537e3e9daa5d8044ab77b5ac48

SHA512
1ca9e3047436b9dda47479a4d510c6d8c1476091c17c11121ec7d40acb448008b66d7a4723dd13eae5c3da61bf9baa4f37046068afc7f6602b97cf0f909d1380

Download Submit
C:\Windows\System\haPrUDZ.exe

Filesize
2.0MB

MD5
f0073bb1c5f3cc28b0007997beb0b755

SHA1
99e9758afba312774095df1bae35fcbacf524fb2

SHA256
a0803515cc551432ae280345cee8cf0c8393b8fbb5a4ec9d67bd529903f2f555

SHA512
1ee13764d12f031347c61ffdd3b0cf1fd92af7998e3bc09353a0e95f18131df408476ca3bb9e11724e01507ddee306cd3b68f13333b30e1513b5beb3d4392201

Download Submit
C:\Windows\System\iKhczKu.exe

Filesize
2.0MB

MD5
73ddf44a2c115eaa2cbb1ec83cce1df3

SHA1
a602e33e2c4bcb01e6b0adccca3bfcd8465b8251

SHA256
8ba6d5a23e37a620a47563d9317640ed9a12d4c680bfd6b652cbffb9f8c9ab23

SHA512
3ecb1d7c26f51831e321c0a9f0eea35bbaf371a8bbcdd23c2262c39bd112d8a029369565ae8213fd1dab6bd614b780bec50e93050184c9395d9ff474043e77e6

Download Submit
C:\Windows\System\iysQpeg.exe

Filesize
2.0MB

MD5
4bff53bff1c85a2d7f96ec63b531b8cc

SHA1
b3eeda71796c2e80862203fa7333e589a9bf1704

SHA256
ffaf0c46760db095f7a626c688545a9c3dd6defb9708fffa0323e93a85824ad0

SHA512
bc443b6ab1b2f90150120f251fa9c83187b236a5239597e9ae204e9e224ad696f02efa1f434d36473bf5cefb95785c5250796ca5e9db2391c15ef60afb51425e

Download Submit
C:\Windows\System\jsJyosj.exe

Filesize
2.0MB

MD5
6efd815e2892dd91d553fd235da19582

SHA1
8b2ba842ba75c250b0ed4cf117e2dd0d73af5420

SHA256
7d9bb69adc01df33caa6e1eef0f6cb8f1012cccafe8533501b2b9df36873c7a7

SHA512
a85d6cdec2cd9a1a844714f3265910fbaeb0fb46c416c998daa34d48005200188b2533f083eabc7df112372fa0c93376ecada99f62adeba1fdf4664c4cd2a3dc

Download Submit
C:\Windows\System\knQOEYk.exe

Filesize
2.0MB

MD5
22b690f2be3854b8a596cf87494c8341

SHA1
d8fca18b1942aad19069c9997e70ca1a61b9b4f2

SHA256
25122ee2ca9d220abe4a47fbc96f7d1498179303399afb37c77d053a73d250f6

SHA512
53fb4d3a904d367d02a55c9fc192d036fe60837b00cdbd5aedfabf0159ad9779c82f9900c55e326860ebec5a996418224b14cacf18751edf0e0bf88e5907d67b

Download Submit
C:\Windows\System\qdxUpCA.exe

Filesize
2.0MB

MD5
f8a330ca7ef484bd1ac4198f86beccdf

SHA1
f80efb6ce3ba4d48392535ae341790a4aa10b298

SHA256
fdad182df20af460ce9a4a8e4f37b30254f4f97a1429f55bf9b523e6a227f881

SHA512
da8c87d0059ca00dbe60d78321079ff71f2dfbde28b3689d3d3a44f335eccb0b1dcaf6a9a06c9ac631d3f1ef11bd71fd8a3043669286db9525ebdffb4dce02b3

Download Submit
C:\Windows\System\tVGNCBG.exe

Filesize
2.0MB

MD5
1f6488a292f545f6389126ffacbc7f5f

SHA1
8da6db365b4d27837008a4cc96cbc4a95f4a6d53

SHA256
8cf8a128baed8a439801076de48f12cab493041af26aa8ca3ccbc5287a013cb7

SHA512
53e506e866734cb041132293f3ab8a14ccb145c642b957b19d4719a86b1662d21c532ee8f6550bded7385e1326cdb633be246a41a8d2320b18be51a8f91da972

Download Submit
C:\Windows\System\udPhBFa.exe

Filesize
2.0MB

MD5
2879dc0a5f0424037d8cee8053b3d6f6

SHA1
65795d408372a534d4da0792f913f9416f9e0b7c

SHA256
f75b57ede1d84d357ae81d2a2f1327b2b138d755ae826819599ee8980fa14d9a

SHA512
25ceea384fe25b18a20fcf0dbc486a8de5e90e2bf2a1ed5772a446de3be8e597569cade1c5297e5ae0c6bb8cb5e713b45a89eb584d9b6175488f980d961c7aa1

Download Submit
C:\Windows\System\wWLfiru.exe

Filesize
2.0MB

MD5
0a3422ff1603640124b78a83d9ea6c57

SHA1
d78044a8599c63c84dc87971a14e185c85361f4c

SHA256
ab48ecd4427c0dd32190f702f88510522d4a133c2942c3c4faf22f2c733331ad

SHA512
74f977226b1603b1cdb2093a0f892e88962b3dbe908f7cc5ceb029ef004a6d72cfd7d906381f9a435bbb3f5280fa8bb9f30824adc48d007d261b2cd02a597fb0

Download Submit
C:\Windows\System\wmOzHaL.exe

Filesize
2.0MB

MD5
052deb9c49c99370000d9e2dc54eb34e

SHA1
7d97b36941241d6c193c917002f382fa5d9aa589

SHA256
656f00bed6d9620cce662a0a3ace5879e3a81f99c648b16c29690ee698fe351d

SHA512
0a938d314cd1ea720dee92fe4f4a0a855f1113b2c8af1d79361cc5a137992b7844d8faf97ba3de42535a4f78d6393b2bb097970e1984da9ca93cdf5f1976c2ac

Download Submit
C:\Windows\System\wnzDOfm.exe

Filesize
2.0MB

MD5
55fc8da6ab846e3a1ba7f12495580194

SHA1
e5e6883529f73813d0e9e3bc77bc2bfabd3175bd

SHA256
7cec2ccd9def951d2bde8f6f5ce4684e19d0076a78a03bfb4aa00aeb55b8b8e1

SHA512
405b5e80fcc0babb2336af948783c30a6a8ed00c365929d38d3397acfb163ac3e6413a0fc4600154c35e1b149b94d1f5291b82235841f8b7a88cafae34ea67f4

Download Submit
memory/64-2131-0x00007FF7BAEE0000-0x00007FF7BB234000-memory.dmp

Filesize
3.3MB

Download
memory/64-22-0x00007FF7BAEE0000-0x00007FF7BB234000-memory.dmp

Filesize
3.3MB

Download
memory/400-163-0x00007FF7259D0000-0x00007FF725D24000-memory.dmp

Filesize
3.3MB

Download
memory/400-2148-0x00007FF7259D0000-0x00007FF725D24000-memory.dmp

Filesize
3.3MB

Download
memory/724-2125-0x00007FF660F40000-0x00007FF661294000-memory.dmp

Filesize
3.3MB

Download
memory/724-37-0x00007FF660F40000-0x00007FF661294000-memory.dmp

Filesize
3.3MB

Download
memory/724-2132-0x00007FF660F40000-0x00007FF661294000-memory.dmp

Filesize
3.3MB

Download
memory/1068-156-0x00007FF7214E0000-0x00007FF721834000-memory.dmp

Filesize
3.3MB

Download
memory/1068-2150-0x00007FF7214E0000-0x00007FF721834000-memory.dmp

Filesize
3.3MB

Download
memory/1504-2139-0x00007FF6B5090000-0x00007FF6B53E4000-memory.dmp

Filesize
3.3MB

Download
memory/1504-2128-0x00007FF6B5090000-0x00007FF6B53E4000-memory.dmp

Filesize
3.3MB

Download
memory/1504-80-0x00007FF6B5090000-0x00007FF6B53E4000-memory.dmp

Filesize
3.3MB

Download
memory/1620-2133-0x00007FF66CAD0000-0x00007FF66CE24000-memory.dmp

Filesize
3.3MB

Download
memory/1620-49-0x00007FF66CAD0000-0x00007FF66CE24000-memory.dmp

Filesize
3.3MB

Download
memory/1700-2137-0x00007FF638170000-0x00007FF6384C4000-memory.dmp

Filesize
3.3MB

Download
memory/1700-95-0x00007FF638170000-0x00007FF6384C4000-memory.dmp

Filesize
3.3MB

Download
memory/1880-2142-0x00007FF7E38C0000-0x00007FF7E3C14000-memory.dmp

Filesize
3.3MB

Download
memory/1880-171-0x00007FF7E38C0000-0x00007FF7E3C14000-memory.dmp

Filesize
3.3MB

Download
memory/1960-170-0x00007FF627820000-0x00007FF627B74000-memory.dmp

Filesize
3.3MB

Download
memory/1960-2144-0x00007FF627820000-0x00007FF627B74000-memory.dmp

Filesize
3.3MB

Download
memory/2012-2138-0x00007FF7B2C30000-0x00007FF7B2F84000-memory.dmp

Filesize
3.3MB

Download
memory/2012-169-0x00007FF7B2C30000-0x00007FF7B2F84000-memory.dmp

Filesize
3.3MB

Download
memory/2424-175-0x00007FF6D5BC0000-0x00007FF6D5F14000-memory.dmp

Filesize
3.3MB

Download
memory/2424-2158-0x00007FF6D5BC0000-0x00007FF6D5F14000-memory.dmp

Filesize
3.3MB

Download
memory/2564-157-0x00007FF612490000-0x00007FF6127E4000-memory.dmp

Filesize
3.3MB

Download
memory/2564-2147-0x00007FF612490000-0x00007FF6127E4000-memory.dmp

Filesize
3.3MB

Download
memory/2800-164-0x00007FF776BE0000-0x00007FF776F34000-memory.dmp

Filesize
3.3MB

Download
memory/2800-2156-0x00007FF776BE0000-0x00007FF776F34000-memory.dmp

Filesize
3.3MB

Download
memory/2852-144-0x00007FF6EC920000-0x00007FF6ECC74000-memory.dmp

Filesize
3.3MB

Download
memory/2852-2143-0x00007FF6EC920000-0x00007FF6ECC74000-memory.dmp

Filesize
3.3MB

Download
memory/3256-2149-0x00007FF7CE060000-0x00007FF7CE3B4000-memory.dmp

Filesize
3.3MB

Download
memory/3256-173-0x00007FF7CE060000-0x00007FF7CE3B4000-memory.dmp

Filesize
3.3MB

Download
memory/3308-147-0x00007FF60B990000-0x00007FF60BCE4000-memory.dmp

Filesize
3.3MB

Download
memory/3308-2151-0x00007FF60B990000-0x00007FF60BCE4000-memory.dmp

Filesize
3.3MB

Download
memory/3404-47-0x00007FF7BCAF0000-0x00007FF7BCE44000-memory.dmp

Filesize
3.3MB

Download
memory/3404-2126-0x00007FF7BCAF0000-0x00007FF7BCE44000-memory.dmp

Filesize
3.3MB

Download
memory/3404-2136-0x00007FF7BCAF0000-0x00007FF7BCE44000-memory.dmp

Filesize
3.3MB

Download
memory/3504-2129-0x00007FF769240000-0x00007FF769594000-memory.dmp

Filesize
3.3MB

Download
memory/3504-107-0x00007FF769240000-0x00007FF769594000-memory.dmp

Filesize
3.3MB

Download
memory/3504-2141-0x00007FF769240000-0x00007FF769594000-memory.dmp

Filesize
3.3MB

Download
memory/3636-2134-0x00007FF6E2F50000-0x00007FF6E32A4000-memory.dmp

Filesize
3.3MB

Download
memory/3636-168-0x00007FF6E2F50000-0x00007FF6E32A4000-memory.dmp

Filesize
3.3MB

Download
memory/3792-166-0x00007FF731720000-0x00007FF731A74000-memory.dmp

Filesize
3.3MB

Download
memory/3792-2155-0x00007FF731720000-0x00007FF731A74000-memory.dmp

Filesize
3.3MB

Download
memory/3892-124-0x00007FF705180000-0x00007FF7054D4000-memory.dmp

Filesize
3.3MB

Download
memory/3892-2140-0x00007FF705180000-0x00007FF7054D4000-memory.dmp

Filesize
3.3MB

Download
memory/4056-2152-0x00007FF7BF2F0000-0x00007FF7BF644000-memory.dmp

Filesize
3.3MB

Download
memory/4056-172-0x00007FF7BF2F0000-0x00007FF7BF644000-memory.dmp

Filesize
3.3MB

Download
memory/4148-2145-0x00007FF6EAFA0000-0x00007FF6EB2F4000-memory.dmp

Filesize
3.3MB

Download
memory/4148-143-0x00007FF6EAFA0000-0x00007FF6EB2F4000-memory.dmp

Filesize
3.3MB

Download
memory/4204-165-0x00007FF7300C0000-0x00007FF730414000-memory.dmp

Filesize
3.3MB

Download
memory/4204-2154-0x00007FF7300C0000-0x00007FF730414000-memory.dmp

Filesize
3.3MB

Download
memory/4260-167-0x00007FF6E41B0000-0x00007FF6E4504000-memory.dmp

Filesize
3.3MB

Download
memory/4260-2157-0x00007FF6E41B0000-0x00007FF6E4504000-memory.dmp

Filesize
3.3MB

Download
memory/4324-0-0x00007FF712F50000-0x00007FF7132A4000-memory.dmp

Filesize
3.3MB

Download
memory/4324-1-0x000001D8CDF10000-0x000001D8CDF20000-memory.dmp

Filesize
64KB

Download
memory/4328-9-0x00007FF795090000-0x00007FF7953E4000-memory.dmp

Filesize
3.3MB

Download
memory/4328-2124-0x00007FF795090000-0x00007FF7953E4000-memory.dmp

Filesize
3.3MB

Download
memory/4328-2130-0x00007FF795090000-0x00007FF7953E4000-memory.dmp

Filesize
3.3MB

Download
memory/4776-174-0x00007FF602D40000-0x00007FF603094000-memory.dmp

Filesize
3.3MB

Download
memory/4776-2153-0x00007FF602D40000-0x00007FF603094000-memory.dmp

Filesize
3.3MB

Download
memory/4900-2146-0x00007FF7D7FB0000-0x00007FF7D8304000-memory.dmp

Filesize
3.3MB

Download
memory/4900-162-0x00007FF7D7FB0000-0x00007FF7D8304000-memory.dmp

Filesize
3.3MB

Download
memory/5088-64-0x00007FF756A90000-0x00007FF756DE4000-memory.dmp

Filesize
3.3MB

Download
memory/5088-2127-0x00007FF756A90000-0x00007FF756DE4000-memory.dmp

Filesize
3.3MB

Download
memory/5088-2135-0x00007FF756A90000-0x00007FF756DE4000-memory.dmp

Filesize
3.3MB

Download